Potential Suspicious Activity Using SeCEdit

Title: Potential Suspicious Activity Using SeCEdit
Status: test
Description:Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
References:
  -https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit
Author: Janantha Marasinghe
Date: 2022-11-18
modified:2022-12-30
Tags:

• -'attack.collection'
• -'attack.discovery'
• -'attack.persistence'
• -'attack.credential-access'
• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.stealth'
• -'attack.defense-impairment'
• -'attack.t1685.001'
• -'attack.t1547.001'
• -'attack.t1505.005'
• -'attack.t1556.002'
• -'attack.t1685'
• -'attack.t1574.007'
• -'attack.t1564.002'
• -'attack.t1546.008'
• -'attack.t1546.007'
• -'attack.t1547.014'
• -'attack.t1547.010'
• -'attack.t1547.002'
• -'attack.t1557'
• -'attack.t1082'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\secedit.exe' OriginalFileName:'SeCEdit'   selection_flags_discovery:
    CommandLine|contains|all:
      -'/export'
      -'/cfg'

  selection_flags_configure:
    CommandLine|contains|all:
      -'/configure'
      -'/db'

  condition:selection_img and (1 of selection_flags_*)
Falsepositives:
  -Legitimate administrative use
Level: medium