Outgoing Logon with New Credentials

Status: test
Severity: low
Log source: product windows, service security
Author: Max Altgelt (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects logon events that specify new credentials

Known false positives

Legitimate remote administration activity

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1550` Use Alternate Authentication Material

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4624: An account was successfully logged on.

Rule body

title: Outgoing Logon with New Credentials
id: def8b624-e08f-4ae1-8612-1ba21190da6b
status: test
description: Detects logon events that specify new credentials
references:
    - https://go.recordedfuture.com/hubfs/reports/mtp-2021-0914.pdf
author: Max Altgelt (Nextron Systems)
date: 2022-04-06
tags:
    - attack.lateral-movement
    - attack.t1550
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624
        LogonType: 9
    condition: selection
falsepositives:
    - Legitimate remote administration activity
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    EventID: 4624
    LogonType: 9

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`LogonType`	eq	`9` corpus 8 (sigma 6, elastic 2)	`field:"LogonType" kind:eq value:"9"`

Outgoing Logon with New Credentials

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`