auditpol.exe

  • File Path: C:\Windows\system32\auditpol.exe
  • Description: Audit Policy Program

Hashes

Type Hash
MD5 29A66352A9656748B1C1DA61C7161EDE
SHA1 40B872E7A01DDE110206A7B422DB4135301D620D
SHA256 8362DDED162B118D02528AFEEB3AF60CE0ECD60015FF9A65812F69619D3742A2
SHA384 B4F913F79242CDE1E5747FFF8CAA061C8199E7570A4FD4B19132AD9E167CE9E03D589864B561C52D804D479377A7D6D1
SHA512 3206648AE9318C64F162417480CB8D78F046EFC0C7F2DD84FF97E909A06CE6C3717908D275553DD69B22526274CB85B4549CE014C5617E4902FD66F8AEF79751
SSDEEP 768:2AwAYR3+tERm5za9/3BTpcf9eRp3zj67y1dCoAPSl0AFrP14y13NN0oTeDppoTbP:BwAYR3+tERm5zQpuW3zj65ot+mey13N/
IMP 90AC86A122E388FC7E7952289389E5B0
PESHA1 7F546D31CDFC2E0B4BE0F63C46B182B6F404C27C
PE256 2185F8D3DC40E4E18FF9968512EA476560A3FA1D783728A49AE775510E82C3DF

Runtime Data

Usage (stdout):

Usage: AuditPol command [<sub-command><options>]


Commands (only one command permitted per execution)
  /?               Help (context-sensitive)
  /get             Displays the current audit policy.
  /set             Sets the audit policy.
  /list            Displays selectable policy elements.
  /backup          Saves the audit policy to a file.
  /restore         Restores the audit policy from a file.
  /clear           Clears the audit policy.
  /remove          Removes the per-user audit policy for a user account.
  /resourceSACL    Configure global resource SACLs


Use AuditPol <command> /? for details on each command

Usage (stderr):

Error 0x00000057 occurred:
The parameter is incorrect.


Loaded Modules:

Path
C:\Windows\system32\auditpol.exe
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\SYSTEM32\ntdll.dll

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: AUDITPOL.EXE.MUI
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/73
  • VirusTotal Link: https://www.virustotal.com/gui/file/8362dded162b118d02528afeeb3af60ce0ecd60015ff9a65812f69619d3742a2/detection/

File Similarity (ssdeep match)

File Score
C:\Windows\system32\auditpol.exe 44
C:\WINDOWS\system32\auditpol.exe 40

Possible Misuse

The following table contains possible examples of auditpol.exe being misused. While auditpol.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
atomic-red-team T1562.002.md auditpol /set /category:”Account Logon” /success:disable /failure:disable MIT License. © 2018 Red Canary
atomic-red-team T1562.002.md auditpol /set /category:”Logon/Logoff” /success:disable /failure:disable MIT License. © 2018 Red Canary
atomic-red-team T1562.002.md auditpol /set /category:”Detailed Tracking” /success:disable MIT License. © 2018 Red Canary
atomic-red-team T1562.002.md auditpol /set /category:”Account Logon” /success:enable /failure:enable MIT License. © 2018 Red Canary
atomic-red-team T1562.002.md auditpol /set /category:”Detailed Tracking” /success:enable MIT License. © 2018 Red Canary
atomic-red-team T1562.002.md auditpol /set /category:”Logon/Logoff” /success:enable /failure:enable MIT License. © 2018 Red Canary

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.


auditpol

Displays information about and performs functions to manipulate audit policies, including:

  • Setting and querying a system audit policy.

  • Setting and querying a per-user audit policy.

  • Setting and querying auditing options.

  • Setting and querying the security descriptor used to delegate access to an audit policy.

  • Reporting or backing up an audit policy to a comma-separated value (CSV) text file.

  • Loading an audit policy from a CSV text file.

  • Configuring global resource SACLs.

Syntax

auditpol command [<sub-command><options>]

Parameters

Sub-command Description
/get Displays the current audit policy. For more information, see auditpol get for syntax and options.
/set Sets the audit policy. For more information, see auditpol set for syntax and options.
/list Displays selectable policy elements. For more information, see auditpol list for syntax and options.
/backup Saves the audit policy to a file. For more information, see auditpol backup for syntax and options.
/restore Restores the audit policy from a file that was previously created by using auditpol /backup. For more information, see auditpol restore for syntax and options.
/clear Clears the audit policy. For more information, see auditpol clear for syntax and options.
/remove Removes all per-user audit policy settings and disables all system audit policy settings. For more information, see auditpol remove for syntax and options.
/resourceSACL Configures global resource system access control lists (SACLs). Note: Applies only to Windows 7 and Windows Server 2008 R2. For more information, see auditpol resourceSACL.
/? Displays help at the command prompt.

Additional References


MIT License. Copyright (c) 2020-2021 Strontic.