Question Analysis

DeviceProcessEvents | where ActionType == "ProcessCreated" | where tolower(FileName) == "secedit.exe" // Must be an export action | where ProcessCommandLine matches regex @'(?i)(?:^|\s)[/-]export(?:\s|$)' // Elevated token (either explicit elevation flag or high/system integrity) | where ProcessTokenElevation =~ "Elevated" or ProcessIntegrityLevel in~ ("High", "System") // Extract the policy output path after /cfg (handles quotes and no quotes) | extend SavedPolicyPath = coalesce( extract(@'(?i)(?:^|\s)[/-]cfg\s+"([^"]+)"', 1, ProcessCommandLine), extract(@'(?i)(?:^|\s)[/-]cfg\s+(\S+)', 1, ProcessCommandLine) ) | extend SavedPolicyFileName = tostring(extract(@'([^\\/:*?"<>|]+)$', 1, SavedPolicyPath)) // Optional: also capture /log file if present | extend LogFilePath = coalesce( extract(@'(?i)(?:^|\s)[/-]log\s+"([^"]+)"', 1, ProcessCommandLine), extract(@'(?i)(?:^|\s)[/-]log\s+(\S+)', 1, ProcessCommandLine) ) | extend LogFileName = tostring(extract(@'([^\\/:*?"<>|]+)$', 1, LogFilePath)) | where isnotempty(SavedPolicyFileName) | project TimeGenerated, DeviceName, AccountDomain, AccountName, ProcessTokenElevation, ProcessIntegrityLevel, ProcessCommandLine, SavedPolicyPath, SavedPolicyFileName, LogFilePath, LogFileName | order by TimeGenerated desc

// 1. Filter for SecEdit executions // 2. Keep only runs that performed an export of the Local Security Policy // 3. Make sure the process was running elevated (token elevation or high integrity) // 4. Parse the value that follows the “/cfg” switch – this is the path where the policy is written // 5. Split the path to obtain the file name only // 6. Summarise so we get a single (latest) record per device / user / output file DeviceProcessEvents | where FileName =~ "secedit.exe" | where ProcessCommandLine has_any ("/export", " /export", "/EXPORT") | where ProcessTokenElevation =~ "Elevated" or ProcessIntegrityLevel in ("High", "System") // try to capture something like /cfg C:\Temp\policydump.txt (quotes optional) | extend ExportedPolicyPath = extract("/cfg\\s+\"?([^\\s\"]+\\.txt)", 1, ProcessCommandLine) | where isnotempty(ExportedPolicyPath) | extend ExportedPolicyFileName = tostring(split(ExportedPolicyPath, "\\")[-1]) | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, ExportedPolicyPath, ExportedPolicyFileName | summarize LatestExportTime = max(TimeGenerated) by DeviceName, AccountName, ExportedPolicyPath, ExportedPolicyFileName | order by LatestExportTime desc

DeviceProcessEvents | where FileName =~ "SecEdit.exe" | where ProcessCommandLine contains "/export" // Optionally, ensure the process was elevated // | where ProcessTokenElevation has "Elevated" | extend ExportedFile = extract("(?i)/cfg\\s+(\\S+)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, ProcessCommandLine, ExportedFile