Detection rules › Sigma
RottenPotato Like Attack Pattern
Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | |
| Collection |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4624: An account was successfully logged on. |
Rule body
title: RottenPotato Like Attack Pattern
id: 16f5d8ca-44bd-47c8-acbe-6fc95a16c12f
status: test
description: Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like
references:
- https://twitter.com/SBousseaden/status/1195284233729777665
author: '@SBousseaden, Florian Roth'
date: 2019-11-15
modified: 2022-12-22
tags:
- attack.collection
- attack.privilege-escalation
- attack.credential-access
- attack.t1557.001
logsource:
product: windows
service: security
detection:
selection:
EventID: 4624
LogonType: 3
TargetUserName: 'ANONYMOUS LOGON'
WorkstationName: '-'
IpAddress:
- '127.0.0.1'
- '::1'
condition: selection
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID: 4624
LogonType: 3
TargetUserName: 'ANONYMOUS LOGON'
WorkstationName: '-'
IpAddress:
- '127.0.0.1'
- '::1'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
IpAddress | eq |
| field:"src_ip" kind:eq |
LogonType | eq |
| field:"LogonType" kind:eq value:"3" |
TargetUserName | eq |
| field:"TargetUserName" kind:eq value:"ANONYMOUS LOGON" |
WorkstationName | eq |
| field:"WorkstationName" kind:eq value:"-" |