Detection rules › Sigma
RottenPotato Like Attack Pattern
Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1557.001 Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay |
| Collection | T1557.001 Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4624 | An account was successfully logged on. |
Rule body yaml
title: RottenPotato Like Attack Pattern
id: 16f5d8ca-44bd-47c8-acbe-6fc95a16c12f
status: test
description: Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like
references:
- https://twitter.com/SBousseaden/status/1195284233729777665
author: '@SBousseaden, Florian Roth'
date: 2019-11-15
modified: 2022-12-22
tags:
- attack.collection
- attack.privilege-escalation
- attack.credential-access
- attack.t1557.001
logsource:
product: windows
service: security
detection:
selection:
EventID: 4624
LogonType: 3
TargetUserName: 'ANONYMOUS LOGON'
WorkstationName: '-'
IpAddress:
- '127.0.0.1'
- '::1'
condition: selection
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID: 4624
LogonType: 3
TargetUserName: 'ANONYMOUS LOGON'
WorkstationName: '-'
IpAddress:
- '127.0.0.1'
- '::1'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
IpAddress | eq |
|
LogonType | eq |
|
TargetUserName | eq |
|
WorkstationName | eq |
|