Configure Windows Audit Policy, Sysmon and Atomic Red Team — Part 3

Windows Audit Policy, Sysmon, and Atomic Red Team — Part 3

Now that we have successfully set up Elasticsearch and Kibana, let’s edit the policies in:

Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies.

Enable Advanced Audit Policies

Under System Audit Policies, configure the following key categories to log critical events:

1. Account Logon

Audit Credential Validation:

Success and Failure

Captures events like successful/failed credential validation.

Audit Kerberos Authentication Service:

Success and Failure

Logs Kerberos ticket-granting events.

2. Account Management

Audit User Account Management:

Success and Failure

Tracks changes to user accounts, including password resets or account lockouts.

3. Logon/Logoff

Audit Logon:

Success and Failure

Captures user logons and logoffs, including RDP sessions.

Audit Special Logon:

Success

Logs events when privileged accounts are used.

Audit Logoff:

Success

Tracks when users log off.

4. Object Access

Audit File System:

Success and Failure

Tracks file/folder access events.

Audit Registry:

Success and Failure

Logs registry access attempts.

5. Detailed Tracking

Audit Process Creation:

Success

Logs every process created on the system (e.g., a PowerShell script execution).

Audit Process Termination:

Success

Tracks when processes terminate.

6. Privilege Use

Audit Sensitive Privilege Use:

Success and Failure

Logs usage of sensitive privileges like SeDebugPrivilege.

Once you’ve configured the policies, make sure they’re applied to the client machine:

1. On the Windows client, open Command Prompt as Administrator.
2. Run the following command:

gpupdate /force

This will enforce the updated Group Policy settings immediately.

Sysmon Configuration

To gain deeper insight into system activities like process creation, network connections, and file modifications, we’re going to also install Sysmon from the official Sysinternals suite download page(https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon).

We’ll use SwiftOnSecurity’s community tested configuration file to ensure we capture the most relevant and security focused events.

Run the following PowerShell command on your Windows machine:

Invoke-WebRequest -Uri "https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/refs/heads/master/sysmonconfig-export.xml" -OutFile "C:\Users\Administrator\Downloads\Sysmon\sysmonconfig-export.xml"

Run the following command from the Sysmon directory:

Sysmon64.exe -c sysmonconfig-export.xml

This tells Sysmon to load and apply the configuration file you downloaded without reinstalling the service.

Complete!

Jobs not finished.

Atomic Red Team Installation

Before we can use Atomic Red Team, install the powershell-yaml module:

Install-Module -Name powershell-yaml

Use this command to download and install the Atomic Red Team framework, including all test files (“atomics”):

IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing); Install-AtomicRedTeam -getAtomics -Force

This script will:

• Clone the Atomics GitHub repo to C:\AtomicRedTeam
• Install helper functions into invoke-atomicredteam

To make the Invoke-AtomicTest command available in every PowerShell session:

notepad $profile

Add the following lines:

Import-Module "C:\AtomicRedTeam\invoke-atomicredteam\Invoke-AtomicRedTeam.psd1" -Force
$PSDefaultParameterValues = @{"Invoke-AtomicTest:PathToAtomicsFolder"="C:\AtomicRedTeam\atomics"}

Save and restart PowerShell.

The script below runs several Atomic tests that span multiple attack stages.

powershell -enc SQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBUAGUAcwB0ACAAVAAxADUANgA2AC4AMAAwADEALQAxADsASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBUAGUAcwB0ACAAVAAxADAANwA4AC4AMAAwADMALQAxADsASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBUAGUAcwB0ACAAVAAxADUANAA3AC4AMAAwADEALQAxADsASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBUAGUAcwB0ACAAVAAxADAAMAA3AC0AMQA7AEkAbgB2AG8AawBlAC0AQQB0AG8AbQBpAGMAVABlAHMAdAAgAFQAMQAwADEANgAtADEAOwBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIABUADEAMAA0ADkALQAxADsASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBUAGUAcwB0ACAAVAAxADAAOAA3AC4AMAAwADEALQA4ADsASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBUAGUAcwB0ACAAVAAxADAAMQA2AC0ANwAgAC0ARwBlAHQAUAByAGUAcgBlAHEAcwA7AEkAbgB2AG8AawBlAC0AQQB0AG8AbQBpAGMAVABlAHMAdAAgAFQAMQAwADEANgAtADcAOwBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIABUADEAMAA1ADkALgAwADAAMQAtADEAOwBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIABUADEANQA2ADcALgAwADAAMwAtADEA > $null

We can see the PowerShell script in our logs, very nice!

One step closer :)