Kill Chain Audit Policy — GPO and Intune Runbook

Purpose

This runbook documents the Windows audit policy and process creation logging configuration required for kill chain detection in cirius-logging-law-central. It serves as both an implementation guide and compliance evidence for HIPAA §164.312(b) (Audit Controls).

The goal is to ensure every stage of a Windows-based ransomware kill chain generates auditable events that reach the SecurityEvent table in Sentinel.

---

Background

Windows process creation events (EventID 4688) are the primary data source for execution and credential dumping detection. By default, process creation auditing is disabled and CommandLine logging is not included. This runbook enables both.

PowerShell script block logging (EventID 4103/4104) provides visibility into encoded and obfuscated commands that bypass process-level detection.

---

Scope

Scope	Method	Target
AD-joined servers (Azure VMs)	Group Policy Object (GPO)	All OUs containing production servers
Non-AD devices (home computers, personal endpoints)	Intune Settings Catalog	All enrolled devices

---

GPO Configuration — AD-Joined Servers

Prerequisites

• Domain Admin or GPO editor rights
• Group Policy Management Console (GPMC)
• Target: OU containing all production Windows servers

Step 1 — Audit Process Creation

Setting	Path	Value
Audit Process Creation	Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Detailed Tracking → Audit Process Creation	Success

1. Open GPMC → right-click target OU → Create a GPO or edit existing
2. Navigate to: Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → System Audit Policies → Detailed Tracking
3. Open Audit Process Creation
4. Check Configure the following audit events: Success
5. Click OK

Step 2 — Enable CommandLine Logging

This registry key instructs the audit subsystem to include the full command line in the 4688 event. Without it, CommandLine is blank.

Setting	Path	Value
Include command line in process creation events	Computer Configuration → Administrative Templates → System → Audit Process Creation	Enabled

Alternative — Registry key (if deploying via script):

Key	Value	Type	Data
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit	ProcessCreationIncludeCmdLine_Enabled	DWORD	1

Step 3 — PowerShell Script Block Logging

Setting	Path	Value
Turn on PowerShell Script Block Logging	Computer Configuration → Administrative Templates → Windows Components → Windows PowerShell → Turn on PowerShell Script Block Logging	Enabled
Log script block invocation start/stop events	(sub-option within above)	Enabled

Note: Script block logging generates EventIDs 4103 and 4104. EventID 4104 captures the full script content including deobfuscated output — high detection value for encoded payloads.

Step 4 — Verify GPO Application

After applying the GPO, run on a target server:

gpresult /r
auditpol /get /subcategory:"Process Creation"

Expected output from auditpol:

System audit policy
Category/Subcategory                      Setting
Detailed Tracking
  Process Creation                        Success

---

Intune Settings Catalog — Non-AD Devices

Prerequisites

• Intune Administrator role
• Target: Endpoint Security or Configuration policy assigned to Windows device group

Settings to Configure

Setting	Catalog Path	Value
Enable Process Creation Command Line	MSSecurityGuide → Enable ProcessCreationCommandLine	Enabled
Turn On Script Block Logging	Windows Components → PowerShell → Turn on Script Block Logging	Enabled

Step-by-Step

1. Intune portal → Devices → Configuration profiles → Create profile
2. Platform: Windows 10 and later
3. Profile type: Settings catalog
4. Add settings:
   • Search ProcessCreationCommandLine → enable MSSecurityGuide: Enable ProcessCreationCommandLine
   • Search Script Block Logging → enable Turn on PowerShell Script Block Logging
5. Assign to target device group
6. Save and deploy

---

Automated Deployment Scripts

Prefer the scripts over manual steps — they are idempotent and self-documenting.

Script	Purpose	Run On
scripts/Set-KillChainAuditPolicy.ps1	Creates GPO and links to Servers OU	BIZADSAZP01 or CGIADSAZP01
scripts/New-IntuneKillChainProfile.ps1	Creates Intune Settings Catalog profile via Graph API	Cloud PC

Run GPO script first, then Intune script. Both are idempotent — safe to re-run if settings change. After GPO script runs, assign the Intune profile to the enrolled devices group manually in the portal (assignment is out of scope for the script).

---

Verification KQL

Run against cirius-logging-law-central after policy is applied (allow 15 minutes for events to flow):

Confirm 4688 is flowing:

SecurityEvent
| where EventID == 4688
| where TimeGenerated > ago(1h)
| summarize count() by Computer
| order by count_ desc

Confirm CommandLine is populated:

SecurityEvent
| where EventID == 4688
| where TimeGenerated > ago(1h)
| where isnotempty(CommandLine)
| project TimeGenerated, Computer, Account, Process, ParentProcessName, CommandLine
| take 20

Expected: CommandLine column populated with actual process arguments. If blank, CommandLine enrichment registry key is not applied.

Confirm PowerShell script block logging (4104):

SecurityEvent
| where EventID in (4103, 4104)
| where TimeGenerated > ago(1h)
| summarize count() by EventID, Computer

Full kill chain EventID coverage check:

SecurityEvent
| where EventID in (4624, 4625, 4648, 4688, 4698, 4776, 1102, 5140, 7045)
| where TimeGenerated > ago(1h)
| summarize count() by EventID
| order by EventID asc

Expected: All EventIDs present. Key gaps to investigate if missing:

• 4688 absent — Audit Process Creation GPO not applied
• 4688 present, CommandLine blank — ProcessCreationIncludeCmdLine registry key not applied
• 7045 absent — Audit Security System Extension not enabled
• 1102 absent — Audit Security State Change not enabled (or no events yet — this fires only on log clear)

---

EventID Reference

EventID	Description	Kill Chain Stage	Volume
4624	Successful logon	Lateral Movement	High
4625	Failed logon	Credential Dumping	Medium
4648	Logon using explicit credentials	Lateral Movement	Medium
4688	Process creation	Execution, Credential Dumping	Very High
4698	Scheduled task created	Persistence	Low
4776	Credential validation (NTLM/Kerberos)	Initial Access, Lateral Movement	Very High
1102	Audit log cleared	Defense Evasion	Very Low (critical)
5140	Network share object accessed	Lateral Movement	Medium
7045	New service installed	Persistence	Low

Cost note: EventID 4776 fires on every domain authentication and is the highest-volume event in this set. Monitor LAW ingestion cost after rollout. 4688 is the second-highest. If ingestion cost becomes a concern, scope 4688 via XPath to exclude high-frequency, low-value processes (lsass.exe spawning from services.exe is expected — scope instead to unusual parent-child combinations at detection layer, not collection layer).

---

Compliance Relevance

Requirement	Control	How This Addresses It
HIPAA §164.312(b) — Audit Controls	Log user activity	Process creation events provide accountability for all executed programs
HIPAA §164.312(c)(1) — Integrity	Detect unauthorized modifications	7045/4698 detect persistence mechanisms
HITRUST 09.ab — Monitoring System Use	Monitor privileged activity	4688 + CommandLine enables detection of privilege escalation tools
SOC2 CC7.2 — Monitoring	Threat detection	Kill chain events feed 6-stage detection agent coverage

---

Related Documentation

• Alerting Runbook
• Incident Response

Document History

Date	Change	Author
March 2026	Initial draft — GPO config, Intune Settings Catalog, verification KQL, EventID reference	Rory / Kobe