09651036-eca5-4f3a-83fb-0ff12719b201
Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. Operating systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order to make access decisions regarding the modification or deletion of audit tools. Satisfies:
To fix this configure the permissions on the "Eventvwr.exe" file to prevent modification by any groups or accounts other than TrustedInstaller. The default permissions listed below satisfy this requirement:
TrustedInstaller - Full Control
Administrators, SYSTEM, Users, ALL APPLICATION PACKAGES, ALL RESTRICTED APPLICATION PACKAGES - Read & Execute
The default location is the "%SystemRoot%\System32" folder.
Stig: Server
2022:https://www.stigviewer.com/stig/microsoft_windows_server_2022/2023-09-11/finding/V-254299
2019: https://www.stigviewer.com/stig/microsoft_windows_server_2019/2023-09-11/finding/V-205731 / https://www.stigviewer.com/stig/windows_server_2019/2020-06-15/finding/V-93195
2016: https://www.stigviewer.com/stig/microsoft_windows_server_2016/2023-08-22/finding/V-224880 / https://www.stigviewer.com/stig/windows_server_2016/2020-06-16/finding/V-73411
NIST 800-53: AU-9(3),CM-6(a),CM-6(c),CM-6(d),SI-7,SI-7(1),SI-7(6)
NIST Privacy Framework: PR.DS-P1 PR.DS-P2
NIAC: Sec 4(D)(2)(d)
CIS: 1.8.1.4,1.8.1.5,1.8.1.6,6.1.1,6.1.2,6.1.3,6.1.4,6.1.5,6.1.6,6.1.7,6.1.8,6.1.9
SIG: D.7 I.3.14.2 M.1.33 N.5.4.1 U.1.5.2 U.1.11.12
CSA CMM: LOG-04 LOG-09
SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099
MITRE Att&ck: T1070.001