Potential Suspicious Activity Using Secedit.exe

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•38

Detects potential suspicious behavior using secedit.exe, specifically when it is used to export or configure security policies. This could indicate an adversary attempting to discover system configurations or modify them for persistence, defense evasion, or privilege escalation.