WIN8/WIN2012 audit subcategories in OVAL 5.11

[blakefrantz]

Windows 8 and Windows 2012 introduce new audit subcategories that do not appear to be captured in the OVAL 5.11 release planning:
http://oval.mitre.org/language/version5.11/ovaldefinition/documentation/windows-definitions-schema.html#auditeventpolicysubcategories_test

I've pulled all audit sub categories out of NTSecAPI.h in the Win 8 SDK and performed a diff against a prior version. The following items appear to be the new ones that may be good to get into OVAL 5.11. Double checking the diff would not hurt.

Please let me know if I've missed something.

Blake

---

"{0CCE9237-69AE-11D9-BED3-505054503030}": "Audit_AccountManagement_SecurityGroup_defined",
"{0CCE9238-69AE-11D9-BED3-505054503030}": "Audit_AccountManagement_DistributionGroup_defined",
"{0CCE9239-69AE-11D9-BED3-505054503030}": "Audit_AccountManagement_ApplicationGroup_defined",
"{0CCE923A-69AE-11D9-BED3-505054503030}": "Audit_AccountManagement_Others_defined",
"{0CCE923B-69AE-11D9-BED3-505054503030}": "Audit_DSAccess_DSAccess_defined",
"{0CCE923C-69AE-11D9-BED3-505054503030}": "Audit_DsAccess_AdAuditChanges_defined",
"{0CCE923D-69AE-11D9-BED3-505054503030}": "Audit_Ds_Replication_defined",
"{0CCE923E-69AE-11D9-BED3-505054503030}": "Audit_Ds_DetailedReplication_defined",
"{0CCE923F-69AE-11D9-BED3-505054503030}": "Audit_AccountLogon_CredentialValidation_defined",
"{0CCE9240-69AE-11D9-BED3-505054503030}": "Audit_AccountLogon_Kerberos_defined",
"{0CCE9241-69AE-11D9-BED3-505054503030}": "Audit_AccountLogon_Others_defined",
"{0CCE9242-69AE-11D9-BED3-505054503030}": "Audit_AccountLogon_KerbCredentialValidation_defined",
"{0CCE9243-69AE-11D9-BED3-505054503030}": "Audit_Logon_NPS_defined",
"{0CCE9245-69AE-11D9-BED3-505054503030}": "Audit_ObjectAccess_RemovableStorage_defined",
"{0CCE9246-69AE-11D9-BED3-505054503030}": "Audit_ObjectAccess_CbacStaging_defined",
"{0CCE9247-69AE-11D9-BED3-505054503030}": "Audit_Logon_Claims_defined",

[djhaynes]

Thanks for adding this issue Blake! I added the tracker to 5.11.

[blakefrantz]

After another pass of the originally posted list it appears the following audit subcategories do not have an existing state in OVAL. Anything in the original list that does not appear here does have an existing OVAL state:

• Audit_AccountLogon_Kerberos does not seem to have an existing state
  • Note: this is different than the existing Audit_AccountLogon item.
• Audit_AccountLogon_KerbCredentialValidation does not seem to have an existing state.
  • Note: that 'credential_validation' exists but I've mapped that to 'Audit_AccountLogon_CredentialValidation' not 'Audit_AccountLogon_KerbCredentialValidation'
• Audit_Logon_Claims does not appear to have an existing state
• Audit_ObjectAccess_CbacStaging does not appear to have an existing state
• Audit_ObjectAccess_RemovableStorage does not appear to have an existing state

[blakefrantz]

It may be best to update the OVAL schema and docs such that they map states to their corresponding GUID from NTSecApi.h.

http://oval.mitre.org/language/version5.11/ovaldefinition/documentation/windows-definitions-schema.html

[djhaynes]

Mapping the entites to their corresponding GUIDs makes sense to me.

[blakefrantz]

In mapping the children of auditeventpolicysubcategories_state to guids in ntsecapi.h I literally ran out of guids. I also ran out ui options in gpedit that correspond with the audit subcategories. There is one more auditeventpolicysubcategories_state child than guids in ntsecapi.h.

In gpedit, under "Account Logon", there are four audit subcategories defined:

1. Audit Other Account Logon Events
2. Audit Credential Validation
3. Audit Kerberos Service Ticket Operations
4. Audit Kerberos Authentication Service

In ntsecapi.h, there are four AccountLogon guids defined:

1. Audit_AccountLogon_Others / 0cce9241-69ae-11d9-bed3-505054503030
2. Audit_AccountLogon_CredentialValidation / 0cce923f-69ae-11d9-bed3-505054503030
3. Audit_AccountLogon_Kerberos / 0cce9240-69ae-11d9-bed3-505054503030
4. Audit_AccountLogon_KerbCredentialValidation / 0cce9242-69ae-11d9-bed3-505054503030

In auditeventpolicysubcategories_state, there appear to be five children trying to fit in the account logon bucket:

1. other_account_logon_events
2. credential_validation
3. kerberos_service_ticket_operations
4. kerberos_authentication_service
5. kerberos_ticket_events

The pull request has them mapped as follows:

OVALName	NTSecApiHName	NTSecApiHGuid	GPO UI Path
other_account_logon_events	Audit_AccountLogon_Others	0CCE9241-69AE-11D9-BED3-505054503030	Account Logon: Audit Other Account Logon Events
credential_validation	Audit_AccountLogon_CredentialValidation	0CCE923F-69AE-11D9-BED3-505054503030	Account Logon: Audit Credential Validation
kerberos_service_ticket_operations	Audit_AccountLogon_Kerberos	0cce9240-69ae-11d9-bed3-505054503030	Account Logon: Audit Kerberos Service Ticket Operations
kerberos_authentication_service	Audit_AccountLogon_KerbCredentialValidation	0CCE9242-69AE-11D9-BED3-505054503030	Account Logon: Audit Kerboros Authentication Service
kerberos_ticket_events

How are other implementations mapping these?

[solind]

Our interpretation was that KERBEROS_TICKET_EVENTS has no mapping to a GUID -- you'll never get it. I'll deprecate it in 5.11.2.

Edit: Actually it appears it was already deprecated in 5.11!

For 5.11.2, I will add the following subcategory entities:
0CCE9249-69AE-11D9-BED3-505054503030: group_membership
0CCE9248-69AE-11D9-BED3-505054503030: pnp_activity
0CCE9247-69AE-11D9-BED3-505054503030: user_device_claims

[wmunyan]

Also, I think there is one additional GUID introduced in Windows 10 1607:
0CCE924A-69AE-11D9-BED3-505054503030: right_adjusted

[solind]

I actually added that one already; it's audit_detailedtracking_tokenrightadjusted.

<xsd:element name="audit_detailedtracking_tokenrightadjusted" type="win-def:EntityStateAuditType" minOccurs="0">
    <xsd:annotation>
        <xsd:documentation>This subcategory audits when token privileges are enabled or disabled for a specific account’s token. This state corresponds with the following GUID specified in ntsecapi.h: 0cce924a-69ae-11d9-bed3-505054503030.</xsd:documentation>
    </xsd:annotation>
</xsd:element>