# Ensure 'Audit Process Creation' is set to include 'Success'

Necessity: Auditing process creation is a critical security control for detecting, investigating, and responding to malicious activity. It creates a log event each time a new process is started on the system, providing a detailed trail of execution. This data is invaluable for identifying malware execution, unauthorized software usage, and lateral movement by attackers. Failure to enable this audit policy creates a significant blind spot for security monitoring and incident response, making it difficult to trace the actions of an adversary.

Auditing and Remediation: The audit script uses the native 'auditpol' utility to query the current inclusion setting for the 'Process Creation' audit subcategory. The remediation script uses the same 'auditpol' utility with the '/set' parameter to configure the policy for success, failure, or both, based on the input argument, providing a direct method to enforce the desired security state.

Recommended State Rationale:
- Basic: ['Success'] - This level ensures that every successfully launched process is logged. This is the minimum requirement for tracking software execution and establishing a baseline of normal activity.
- Moderate: ['Success and Failure'] - This state logs both successful and failed attempts to create a process. Logging failures is crucial as it can indicate an attacker attempting to execute a payload that is being blocked by security controls, or evidence of privilege-related issues. This provides a more complete security picture.
- Strict: ['Success and Failure'] - This is the most comprehensive and recommended setting. There is no security benefit to logging only one type of event over the other. Capturing both successes and failures provides the complete context needed for effective threat hunting and forensic analysis, making it the highest standard for this control.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the current setting for the 'Process Creation' audit policy. The script must execute the 'auditpol' command, parse the output, and return only the current value for the 'Inclusion Setting' (e.g., 'Success', 'Success and Failure', 'No Auditing'). The output must not contain any labels or extra text.

## Remediation Script Working

PowerShell script that accepts a single string argument to configure the 'Process Creation' audit policy. The argument can be 'Success', 'Failure', 'Success and Failure', or 'No Auditing'. The script will use the 'auditpol' command to apply the setting (e.g., '/success:enable', '/failure:enable'). It must return '$true' if the configuration is successful and '$false' otherwise.

