Detectionmediumexperimental

Potentially Suspicious Explicit Credential Local Logon

Detects potentially suspicious explicit credential logon events where the user is trying to logon with explicit credentials (username and password) that are different from the current user context. It might indicate an attacker attempting to escalate privileges after obtaining credentials for a different user account.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Swachchhanda Shrawan Poudel (Nextron Systems)Created Thu Jul 23e3c6d245-7b8f-4e2a-c17f-a9d0e5b38f62windows

Log Source

Windowssecurity

ProductWindows← raw: windows

Servicesecurity← raw: security

Detection Logic

detection:
    selection_eid:
        EventID: 4648
    selection_localhost:
        - TargetServerName: 'localhost'
        - TargetInfo: 'localhost'
        - IpAddress:
              - '127.0.0.1'
              - '::1'
    filter_main_computer_accounts:
        SubjectUserName|endswith: '$'
    filter_main_system_processes:
        ProcessName|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
            - 'C:\Windows\WinSxS\'
    filter_main_program_files:
        ProcessName|startswith:
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
    filter_main_same_user:
        SubjectUserName|fieldref: TargetUserName
    condition: all of selection_* and not 1 of filter_main_*