Beyond Windows Object Auditing - An Approach to Expanding Detections

Windows object auditing is one of the most powerful features in Windows for the customization of event logs. Although there are a decent number of articles on Windows object auditing, very few discuss uses outside of standard file and folder auditing. The primary focus of its use seems to be to detect insider threats through file and folder auditing. However, some organizations have begun to expand their use of object auditing to integrate honey tokens and other detection edge cases. It is edge cases like this that start to highlight the unique value of Windows object auditing. This paper will explore the edge cases that extend Windows object auditing’s functionality to provide additional value beyond what appears to be its primary use. Honey tokens have been extensively covered, but numerous other edge cases have not. This paper will highlight how to extend the value of Windows object auditing to detect things like Print Nightmare, process execution, USB activity, WMI persistence, and more.