Suspicious Secedit.exe Activity for Security Policy Export or Modification

Google SecOps@GoogleSecOps

•updated Jun 25, 2025•2•0•50

Detects potential suspicious behavior using secedit.exe, specifically when it is used to export or modify the security policy. This could indicate an adversary attempting to understand or alter system security configurations for persistence, privilege escalation, or defense evasion.