Sigma rule: Potential Suspicious Activity Using SeCEdit

Rule

Title

Potential Suspicious Activity Using SeCEdit

Status

test

Level

medium

Author

Janantha Marasinghe

Date

2022-11-18

Modified

2022-12-30

File

rules/windows/process_creation/proc_creation_win_secedit_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith: '\secedit.exe'
    - OriginalFileName: 'SeCEdit'
selection_flags_discovery:
    CommandLine|contains|all:
        - '/export'
        - '/cfg'
selection_flags_configure:
    CommandLine|contains|all:
        - '/configure'
        - '/db'
# filter:
#     SubjectUserName|endswith: '$'  SubjectUserName is from event ID 4719 in the Windows Security log
condition: selection_img and (1 of selection_flags_*)

False positives (as the rule lists them)

• Legitimate administrative use

Tags

• attack.collection
• attack.discovery
• attack.persistence
• attack.credential-access
• attack.privilege-escalation
• attack.execution
• attack.stealth
• attack.defense-impairment
• attack.t1685.001
• attack.t1547.001
• attack.t1505.005
• attack.t1556.002
• attack.t1685
• attack.t1574.007
• attack.t1564.002
• attack.t1546.008
• attack.t1546.007
• attack.t1547.014
• attack.t1547.010
• attack.t1547.002
• attack.t1557
• attack.t1082

MITRE ATT&CK ids this rule names

• T1082
• T1505.005
• T1546.007
• T1546.008
• T1547.001
• T1547.002
• T1547.010
• T1547.014
• T1556.002
• T1557
• T1564.002
• T1574.007
• T1685
• T1685.001

References

• https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d
• https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_secedit_execution.yml