System was recovered from CrashOnAuditFail state. This occurs when audit policy is set to crash system if audit log is full and the log has filled.
CrashOnAuditFail (HKLM\SYSTEM\CurrentControlSet\Control\Lsa\CrashOnAuditFail=2) means an audit log full caused a crash. Attackers may deliberately fill audit logs to cause crashes and disrupt monitoring.
Alert on any occurrence. Investigate why audit log filled — possible log flooding attack.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Defense Evasion | Disable Windows Event Logging (T1562.002) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4621 // Administrator recovered system from CrashOnAuditFail
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:Security" EventCode=4621
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# Administrator recovered system from CrashOnAuditFail — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Administrator recovered system from CrashOnAuditFail. System was recovered from CrashOnAuditFail state. This occurs when audit policy is set to crash system if audit log is full and the log has filled.
Event 4621 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'System' subcategory (Success and/or Failure).
Event 4621 is associated with: Disable Windows Event Logging (T1562.002).
Alert on any occurrence. Investigate why audit log filled — possible log flooding attack.