Detections
Analytics

1.101 WN11-AU-000585

Information

Windows 11 must have command line process auditing events enabled for failures.

GROUP ID: V-257770
RULE ID: SV-257770r958412

When this policy setting is enabled, the operating system generates audit events when a process fails to start and the name of the program or user that created it.

These audit events can assist in understanding how a computer is being used and tracking user activity.

Solution

Go to

Computer Configuration >> Windows Settings >>Security Settings>> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> Set 'Audit Process Creation'

to 'Failure'.

See Also

https://workbench.cisecurity.org/benchmarks/27756

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(9), CCI|CCI-002234, Rule-ID|SV-257770r958412_rule, STIG-ID|WN11-AU-000585, Vuln-ID|V-257770

Plugin: Windows

Control ID: 70de2a703b5c6edb2b7acefe87e9453d565ea31dede8289b2cc80acd90559328