Detectioncriticaltest

DiagTrackEoP Default Login Username

Detects the default "UserName" used by the DiagTrackEoP POC

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems)Created Wed Aug 032111118f-7e46-4fc8-974a-59fd8ec95196windows

Log Source

Windowssecurity

ProductWindows← raw: windows

Servicesecurity← raw: security

Detection Logic

detection:
    selection:
        EventID: 4624
        LogonType: 9
        TargetOutboundUserName: 'thisisnotvaliduser'
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

MITRE ATT&CK

Tactics

Rule Metadata

Rule ID

2111118f-7e46-4fc8-974a-59fd8ec95196

Status

test

Level

critical

Type

Detection

Created

Wed Aug 03

Author

Path

rules/windows/builtin/security/account_management/win_security_diagtrack_eop_default_login_username.yml

Raw Tags

attack.privilege-escalation