liveBook · Manning

Auditpol

As explained in Cyber Threat Hunting

auditpol is a Windows command-line utility for viewing and configuring audit policies.

auditpol is a Windows command-line utility for viewing and configuring audit policies. It can enable process-creation auditing so Windows records Event 4688, including the created process and responsible user. section 10.2.5

A practical process-creation auditing workflow is:

Enable and verify process creation auditing

Run auditpol /set /subcategory:"Process Creation" /success:enable, optionally enable failures, then run auditpol /get /subcategory:"Process Creation" to confirm the setting.

How Cyber Threat Hunting covers it

How deep it goes
Explains configuration switches, success and failure auditing, and verification, while focusing on Process Creation rather than broader policy administration.
Examples
Demonstrates /set and /get commands for Process Creation and shows output reporting Success and Failure.
What it assumes
Requires an elevated Command Prompt or PowerShell session and teaches the relevant auditpol switches from their operational purpose.
What you can do after
Operate/configure auditpol to enable and verify successful or failed process-creation auditing.
How it connects
Connects auditpol with Windows audit policies, Event 4688, process creation, Group Policy, and security or forensic analysis.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.