Detectionmediumtest

Suspicious Remote Logon with Explicit Credentials

Detects suspicious processes logging on with explicit credentials

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

oscd.community, Teymur Kheirkhabarov, Zach Stanford, Tim SheltonCreated Mon Oct 05Updated Wed Aug 03941e5c45-cda7-4864-8cea-bbb7458d194awindows

Log Source

Windowssecurity

ProductWindows← raw: windows

Servicesecurity← raw: security

Detection Logic

detection:
    selection:
        EventID: 4648
        ProcessName|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\winrs.exe'
            - '\wmic.exe'
            - '\net.exe'
            - '\net1.exe'
            - '\reg.exe'
    filter1:
        TargetServerName: 'localhost'
    filter2:
        SubjectUserName|endswith: '$'
        TargetUserName|endswith: '$'
    condition: selection and not 1 of filter*