AC-06(09) Log Use of Privileged Functions
NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
All changes in this version
Title
Log Use of Privileged Functions
Control
Log the execution of privileged functions.
Discussion
The misuse of privileged functions, either intentionally or unintentionally by authorized users or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Logging and analyzing the use of privileged functions is one way to detect such misuse and, in doing so, help mitigate the risk from insider threats and the advanced persistent threat.
Related controls
au-12, au-2, au-3
Assessment objective
AC-06(09) the execution of privileged functions is logged.
STIG rules that implement this control 61
Apple macOS 15 (Sequoia) V1R8
- APPL-15-001001 CAT II The macOS system must be configured to audit all administrative action events.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-001001 CAT II The macOS system must be configured to audit all administrative action events.
Application Security and Development V6R5
- APSC-DV-000520 CAT II The application must audit the execution of privileged functions.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-654230 CAT II Ubuntu 22.04 LTS must prevent all software from executing at higher privilege levels than users executing the software and the audit system must be configured to audit the execution of privileged functions.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-200580 CAT II Ubuntu 24.04 LTS must prevent all software from executing at higher privilege levels than users executing the software and the audit system must be configured to audit the execution of privileged functions.
Cisco IOS XE Router NDM Y26M04
- CISC-ND-000210 CAT II The Cisco device must be configured to audit all administrator activity.
Microsoft Windows 11 V2R11
- WN11-AU-000110 CAT II The system must be configured to audit Privilege Use - Sensitive Privilege Use failures.
- WN11-AU-000585 CAT II Windows 11 must have command line process auditing events enabled for failures.
Microsoft Windows Server 2022 V2R11
- WN22-AU-000090 CAT II Windows Server 2022 must be configured to audit Account Management - Other Account Management Events successes.
- WN22-AU-000140 CAT II Windows Server 2022 must be configured to audit Detailed Tracking - Process Creation successes.
- WN22-AU-000260 CAT II Windows Server 2022 must be configured to audit Policy Change - Audit Policy Change successes.
- WN22-AU-000270 CAT II Windows Server 2022 must be configured to audit Policy Change - Audit Policy Change failures.
- WN22-AU-000280 CAT II Windows Server 2022 must be configured to audit Policy Change - Authentication Policy Change successes.
- WN22-AU-000290 CAT II Windows Server 2022 must be configured to audit Policy Change - Authorization Policy Change successes.
- WN22-AU-000300 CAT II Windows Server 2022 must be configured to audit Privilege Use - Sensitive Privilege Use successes.
- WN22-AU-000310 CAT II Windows Server 2022 must be configured to audit Privilege Use - Sensitive Privilege Use failures.
- WN22-AU-000320 CAT II Windows Server 2022 must be configured to audit System - IPsec Driver successes.
- WN22-AU-000330 CAT II Windows Server 2022 must be configured to audit System - IPsec Driver failures.
- WN22-AU-000340 CAT II Windows Server 2022 must be configured to audit System - Other System Events successes.
- WN22-AU-000350 CAT II Windows Server 2022 must be configured to audit System - Other System Events failures.
- WN22-AU-000360 CAT II Windows Server 2022 must be configured to audit System - Security State Change successes.
- WN22-AU-000370 CAT II Windows Server 2022 must be configured to audit System - Security System Extension successes.
- WN22-AU-000380 CAT II Windows Server 2022 must be configured to audit System - System Integrity successes.
- WN22-AU-000390 CAT II Windows Server 2022 must be configured to audit System - System Integrity failures.
- WN22-DC-000170 CAT II Windows Server 2022 Active Directory Group Policy objects must be configured with proper audit settings.
- WN22-DC-000180 CAT II Windows Server 2022 Active Directory Domain object must be configured with proper audit settings.
- WN22-DC-000190 CAT II Windows Server 2022 Active Directory Infrastructure object must be configured with proper audit settings.
- WN22-DC-000200 CAT II Windows Server 2022 Active Directory Domain Controllers Organizational Unit (OU) object must be configured with proper audit settings.
- WN22-DC-000210 CAT II Windows Server 2022 Active Directory AdminSDHolder object must be configured with proper audit settings.
- WN22-DC-000220 CAT II Windows Server 2022 Active Directory RID Manager$ object must be configured with proper audit settings.
- WN22-DC-000240 CAT II Windows Server 2022 must be configured to audit DS Access - Directory Service Access successes.
- WN22-DC-000250 CAT II Windows Server 2022 must be configured to audit DS Access - Directory Service Access failures.
- WN22-DC-000260 CAT II Windows Server 2022 must be configured to audit DS Access - Directory Service Changes successes.
Microsoft Windows Server 2025 V1R4
- WN25-AU-000090 CAT II Windows Server 2025 must be configured to audit Account Management - Other Account Management Events successes.
- WN25-AU-000140 CAT II Windows Server 2025 must be configured to audit Detailed Tracking - Process Creation successes.
- WN25-AU-000260 CAT II Windows Server 2025 must be configured to audit Policy Change - Audit Policy Change successes.
- WN25-AU-000270 CAT II Windows Server 2025 must be configured to audit Policy Change - Audit Policy Change failures.
- WN25-AU-000280 CAT II Windows Server 2025 must be configured to audit Policy Change - Authentication Policy Change successes.
- WN25-AU-000281 CAT II Windows Server 2025 must be configured to audit Policy Change - Authorization Policy Change successes.
- WN25-AU-000300 CAT II Windows Server 2025 must be configured to audit Privilege Use - Sensitive Privilege Use successes.
- WN25-AU-000310 CAT II Windows Server 2025 must be configured to audit Privilege Use - Sensitive Privilege Use failures.
- WN25-AU-000320 CAT II Windows Server 2025 must be configured to audit System - IPsec Driver successes.
- WN25-AU-000330 CAT II Windows Server 2025 must be configured to audit System - IPsec Driver failures.
- WN25-AU-000340 CAT II Windows Server 2025 must be configured to audit System - Other System Events successes.
- WN25-AU-000350 CAT II Windows Server 2025 must be configured to audit System - Other System Events failures.
- WN25-AU-000360 CAT II Windows Server 2025 must be configured to audit System - Security State Change successes.
- WN25-AU-000370 CAT II Windows Server 2025 must be configured to audit System - Security System Extension successes.
- WN25-AU-000380 CAT II Windows Server 2025 must be configured to audit System - System Integrity successes.
- WN25-AU-000390 CAT II Windows Server 2025 must be configured to audit System - System Integrity failures.
- WN25-DC-000170 CAT II Windows Server 2025 Active Directory Group Policy Objects (GPOs) must be configured with proper audit settings.
- WN25-DC-000180 CAT II Windows Server 2025 Active Directory (AD) Domain object must be configured with proper audit settings.
- WN25-DC-000190 CAT II Windows Server 2025 Active Directory (AD) Infrastructure object must be configured with proper audit settings.
- WN25-DC-000200 CAT II Windows Server 2025 Active Directory (AD) Domain Controllers Organizational Unit (OU) object must be configured with proper audit settings.
- WN25-DC-000210 CAT II Windows Server 2025 Active Directory (AD) AdminSDHolder object must be configured with proper audit settings.
- WN25-DC-000220 CAT II Windows Server 2025 Active Directory (AD) RID Manager$ object must be configured with proper audit settings.
- WN25-DC-000240 CAT II Windows Server 2025 must be configured to audit DS Access - Directory Service Access successes.
- WN25-DC-000250 CAT II Windows Server 2025 must be configured to audit DS Access - Directory Service Access failures.
- WN25-DC-000260 CAT II Windows Server 2025 must be configured to audit DS Access - Directory Service Changes successes.
- WN25-DC-000270 CAT II Windows Server 2025 must be configured to audit DS Access - Directory Service Changes failures.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-500300 CAT II RHEL 10 must generate audit records for successful and unsuccessful uses of the "execve" system call.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-654010 CAT II RHEL 9 must audit uses of the "execve" system call.