Detectioninformationalstable

Locked Workstation

Detects locked workstation session events that occur automatically after a standard period of inactivity.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Alexandr Yampolskyi, SOC PrimeCreated Tue Mar 26Updated Mon Dec 11411742ad-89b0-49cb-a7b0-3971b5c1e0a4windows

Log Source

Windowssecurity

ProductWindows← raw: windows

Servicesecurity← raw: security

Detection Logic

detection:
    selection:
        EventID: 4800
    condition: selection

False Positives

Likely

References

MITRE ATT&CK

Tactics

Rule Metadata

Rule ID

411742ad-89b0-49cb-a7b0-3971b5c1e0a4

Status

stable

Level

informational

Type

Detection

Created

Tue Mar 26

Modified

Mon Dec 11

Author

Path

rules/windows/builtin/security/win_security_workstation_was_locked.yml

Raw Tags

attack.impact