Admin User Remote Logon

Status: test
Severity: low
Log source: product windows, service security
Author: juju4
Source: github.com/SigmaHQ/sigma

Detect remote login by Administrator user (depending on internal pattern).

Known false positives

Legitimate administrative activity.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078.001` Valid Accounts: Default Accounts `T1078.002` Valid Accounts: Domain Accounts `T1078.003` Valid Accounts: Local Accounts
Persistence	`T1078.001` Valid Accounts: Default Accounts `T1078.002` Valid Accounts: Domain Accounts `T1078.003` Valid Accounts: Local Accounts
Privilege Escalation	`T1078.001` Valid Accounts: Default Accounts `T1078.002` Valid Accounts: Domain Accounts `T1078.003` Valid Accounts: Local Accounts
Stealth	`T1078.001` Valid Accounts: Default Accounts `T1078.002` Valid Accounts: Domain Accounts `T1078.003` Valid Accounts: Local Accounts

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4624: An account was successfully logged on.

Rule body

title: Admin User Remote Logon
id: 0f63e1ef-1eb9-4226-9d54-8927ca08520a
status: test
description: Detect remote login by Administrator user (depending on internal pattern).
references:
    - https://car.mitre.org/wiki/CAR-2016-04-005
author: juju4
date: 2017-10-29
modified: 2022-10-09
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.lateral-movement
    - attack.initial-access
    - attack.stealth
    - attack.t1078.001
    - attack.t1078.002
    - attack.t1078.003
    - car.2016-04-005
logsource:
    product: windows
    service: security
    definition: 'Requirements: Identifiable administrators usernames (pattern or special unique character. ex: "Admin-*"), internal policy mandating use only as secondary account'
detection:
    selection:
        EventID: 4624
        LogonType: 10
        AuthenticationPackageName: Negotiate
        TargetUserName|startswith: 'Admin'
    condition: selection
falsepositives:
    - Legitimate administrative activity.
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    EventID: 4624
    LogonType: 10
    AuthenticationPackageName: Negotiate
    TargetUserName|startswith: 'Admin'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AuthenticationPackageName`	eq	`Negotiate` corpus 4 (sigma 4)	`field:"AuthenticationPackageName" kind:eq value:"Negotiate"`
`LogonType`	eq	`10` corpus 8 (kusto 4, sigma 3, splunk 1)	`field:"LogonType" kind:eq value:"10"`
`TargetUserName`	starts_with	`Admin`	`field:"TargetUserName" kind:starts_with value:"Admin"`

Admin User Remote Logon

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`