Detections
Analytics
WN10-AU-000585 - Windows 10 must have command line process auditing events enabled for failures.
Information
When this policy setting is enabled, the operating system generates audit events when a process fails to start and the name of the program or user that created it.These audit events can assist in understanding how a computer is being used and tracking user activity.
Solution
Go to Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >>System Audit Policies >> Detailed Tracking >> Audit Process Creation is set to 'failure'.See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_10_V3R6_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows 10 STIG v3r6
Category: ACCESS CONTROL
References: 800-53|AC-6(9), CAT|II, CCI|CCI-002234, Rule-ID|SV-257589r958412_rule, STIG-ID|WN10-AU-000585, Vuln-ID|V-257589
Plugin: Windows
Control ID: 6847ff934ef5f68eddb23b61e7e3507cb241f0d0a9db1df35ab2b75ffcd33dbc