2

I am experiencing an issue where I am trying to audit a specific registry key via Windows Event ID 4657.

TL; DR: I have tried to setup auditing on a registry key when a new subkey is created under it, but it does not log when this action is performed. After creating the subkey, any changes to the key are then logged. My objective, however, is to log the initial creation of the subkey “\Run” so that I may catch this well know ASEP (Auto-start Extension Point) for signs of malicious activity.

The registry key in question is:

before creation:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current1Version\Policies\Explorer

after creation:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

As you can see in the below screen shot, this specific path does not exist (the “run” subkey has yet to be created).

Figure 1 - registry before change
Figure 1 - registry before change

The auditing permissions (Right-click -> Permissions -> Advanced -> Auditing -> Add) set on this registry subkey are as follows:

Principal: Everyone

Type: All

Applies to: This key and subkeys

Advanced permissions: Full Control (Query Value, Set Value, Create Subkey, Enumerate Subkeys, Notify, Create link, Delete, Write DAC, Write Owner, and Read Control)

For “Only these audit settings to objects and/or containers within this container” check box, I have tested with and without it checked. ->OK->Apply->OK

Figure 2 - Auditing Entry for "Explorer" subkey
Figure 2 - Auditing Entry for "Explorer" subkey

Not sure if this is entirely necessary but also running “gpupdate /force” via admin privileged cmd.exe

Figure 3 - lack of logs
Figure 3 - lack of logs

No logs appear to have been generated as a result of the registry change on the registry key (HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run) which has inherited the auditing settings from its parent key “Explorer”.

GPO settings are as follows:

[Figure 4 - Active Directory Users and Computers settings showing the host being tested has this GP applied
Figure 4 - Active Directory Users and Computers settings showing the host being tested has this GP applied

Figure 5 - Group Policy Management showing Link Enabled
Figure 5 - Group Policy Management showing Link Enabled

Figure 6 - Group Policy Management Editor showing Audit Registry is set to log Success and Failure
Figure 6 - Group Policy Management Editor showing Audit Registry is set to log Success and Failure

Please note that further modifications appear to be logged as expected; creating additional key values & modifying them (under the \Run subkey):

Figure 7 - further modifications are logged
Figure 7 - further modifications are logged

Figure 8 - Only log is generated after subkey creation
Figure 8 - Only log is generated after subkey creation

So as shown above, once the key is created and new values are added under the newly created key it logs this, but it does not log when the new key itself is created.

Am I missing something here? Any and all help is greatly appreciated in advance!

Additional info:

  • DC where GPO is managed is a Microsoft Windows Server 2012 R2 Standard - 6.3.9600 Build 9600 and is configured as the Primary Domain Controller. The machine I am testing these registry changes on is also a Microsoft Windows Server 2012 R2 Standard - 6.3.9600 Build 9600 configured as a Member Server.

  • Using Sysmon is not an option for my current situation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.