STIGQter: STIG Summary: Microsoft Windows Server 2012/2012 R2 Member Server Security Technical Implementation Guide Version: 3 Release: 2 Benchmark Date: 04 May 2021:

Windows 2012 R2 must include command line data in process creation events.

DISA Rule

SV-225410r569185_rule

Vulnerability Number

V-225410

Group Title

SRG-OS-000042-GPOS-00020

Rule Version

WN12-CC-000139

Severity

CAT II

CCI(s)

• CCI-000135 - The information system generates audit records containing the organization-defined additional, more detailed information that is to be included in the audit records.

Weight

10

Fix Recommendation

Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Audit Process Creation >> "Include command line in process creation events" to "Enabled".

Check Contents

This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2.

Verify the registry value below. If it does not exist or is not configured as specified, this is a finding.

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\

Value Name: ProcessCreationIncludeCmdLine_Enabled

Value Type: REG_DWORD
Value: 0x00000001 (1)

Vulnerability Number

V-225410

Documentable

False

Rule Version

WN12-CC-000139

Severity Override Guidance

This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2.

Verify the registry value below. If it does not exist or is not configured as specified, this is a finding.

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\

Value Name: ProcessCreationIncludeCmdLine_Enabled

Value Type: REG_DWORD
Value: 0x00000001 (1)

Check Content Reference

M

Target Key

4214

Comments