Interactive Logon by an Unusual Process

  1[metadata]
  2creation_date = "2023/12/04"
  3integration = ["system", "windows"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies interactive logon attempt with alternate credentials and by an unusual process. Adversaries may create a new
 11token to escalate privileges and bypass access controls.
 12"""
 13from = "now-9m"
 14index = ["logs-system.security*", "logs-windows.forwarded*", "winlogbeat-*"]
 15language = "eql"
 16license = "Elastic License v2"
 17name = "Interactive Logon by an Unusual Process"
 18references = ["https://attack.mitre.org/techniques/T1134/002/"]
 19risk_score = 73
 20rule_id = "61766ef9-48a5-4247-ad74-3349de7eb2ad"
 21severity = "high"
 22tags = [
 23    "Domain: Endpoint",
 24    "OS: Windows",
 25    "Use Case: Threat Detection",
 26    "Tactic: Privilege Escalation",
 27    "Data Source: Windows Security Event Logs",
 28    "Resources: Investigation Guide",
 29    "Noise: Medium",
 30    "Performance: Normal",
 31    "Rule Type: Event Correlation (EQL)",
 32    "Platform: Windows",
 33]
 34timestamp_override = "event.ingested"
 35type = "eql"
 36
 37query = '''
 38authentication where
 39 host.os.type : "windows" and winlog.event_data.LogonProcessName : "Advapi*" and
 40 winlog.logon.type == "Interactive" and winlog.event_data.SubjectUserSid : ("S-1-5-21*", "S-1-12-*") and
 41 winlog.event_data.TargetUserSid : ("S-1-5-21*", "S-1-12-*")  and process.executable : "C:\\*" and
 42 not startswith~(winlog.event_data.SubjectUserSid, winlog.event_data.TargetUserSid) and
 43 not process.executable :
 44            ("?:\\Windows\\System32\\winlogon.exe",
 45             "?:\\Windows\\System32\\wininit.exe",
 46             "?:\\Program Files\\*.exe",
 47             "?:\\Program Files (x86)\\*.exe",
 48             "?:\\Windows\\SysWOW64\\inetsrv\\w3wp.exe",
 49             "?:\\Windows\\System32\\inetsrv\\w3wp.exe",
 50             "?:\\Windows\\SysWOW64\\msiexec.exe")
 51'''
 52
 53note = """## Triage and analysis
 54
 55### Investigating Interactive Logon by an Unusual Process
 56#### Possible investigation steps
 57
 58- Did Advapi create an interactive logon for a different target identity?
 59  - Focus: `winlog.logon.type`, `winlog.event_data.LogonProcessName`, `winlog.event_data.SubjectUserSid`, `winlog.event_data.TargetUserSid`, and `host.id`.
 60  - Implication: escalate when Advapi creates a different Target session without recognized credential-switch use; lower suspicion only for bounded runas or helper use on this host. Subject initiated the action; Target received the session or token.
 61- Which process requested the alternate-credential session?
 62  - Focus: `process.executable`, `process.name`, `process.pid`, `winlog.event_data.SubjectUserName`, and `winlog.event_data.SubjectDomainName`.
 63  - Implication: escalate when the requester is user-writable, temporary, renamed, or unrelated to credential switching; lower suspicion only for System32 runas.exe or a recognized helper tied to the same Subject. Process identity alone does not clear token creation.
 64- Did the Target session create privileged or linked-token access?
 65  - Focus: `winlog.event_data.TargetUserSid`, `winlog.event_data.TargetLogonId`, `winlog.event_data.TargetLinkedLogonId`, `winlog.event_data.ElevatedToken`, and `winlog.event_data.ImpersonationLevel`.
 66  - Implication: escalate on a privileged or unusual Target account, elevated token, linked session, or impersonation-capable token. Keep unresolved when the Target cannot be tied to the requesting Subject and process; a recognized requester does not clear elevated Target token state.
 67- Did explicit-credential records show who supplied Target credentials?
 68  - Focus: same-host 4648 records using `winlog.event_data.SubjectLogonId`; read `winlog.event_data.TargetUserName`, `winlog.event_data.TargetDomainName`, `winlog.event_data.TargetServerName`, and `source.ip`.
 69  - Hint: make-token tooling may leave only Advapi, different Subject/Target SIDs, and Target session fields; do not require endpoint command-line evidence before escalation. $investigate_0
 70  - Implication: escalate when 4648 shows the same Subject session presenting Target credentials to an unexpected server or non-local origin. Local or absent `source.ip` can occur in make-token cases and must be weighed with requester, identity pair, and token state; missing Security telemetry is unresolved, not benign.
 71- Did the created Target session show follow-on success or authentication-method signals?
 72  - Focus: same-host 4624 and 4634 records using `winlog.event_data.TargetLogonId`; read `winlog.event_data.TargetUserSid`, `winlog.event_data.AuthenticationPackageName`, and `source.ip`.
 73  - Implication: escalate on unexpected authentication package use, repeated successful session activity, or a non-local origin that contradicts local workflow; absent or local source details should be weighed with Target-token evidence. Missing 4624/4634 telemetry is unresolved, not benign.
 74    - $investigate_1
 75    - $investigate_2
 76- What activity is tied to the created Target logon session?
 77  - Focus: same-host events carrying `winlog.event_data.TargetLogonId`, especially process, privilege, or authentication records tied to the Target identity. $investigate_3
 78  - Implication: escalate when the Target session performs privileged operations, starts unexpected processes, or chains authentication; no follow-on telemetry narrows activity only when the requester, identity pair, and token state are otherwise explained.
 79- If local evidence remains suspicious or unresolved, do related alerts change scope?
 80  - Focus: recent alerts for the same `host.id`, Subject SID, and Target SID.
 81    - $investigate_4
 82    - $investigate_5
 83    - $investigate_6
 84  - Implication: broaden scope when related alerts show credential access, privilege escalation, persistence, or lateral movement tied to the host or either identity; quiet alert history cannot close unresolved token/session evidence.
 85- Escalate on unauthorized Subject-to-Target token creation; close only when the identity pair, requester, Target token, and Security records all bind to one recognized workflow; if mixed, preserve records and use related alerts plus recent session activity to scope the case.
 86
 87### False positive analysis
 88
 89- Recognized runas, enterprise PAM or credential-broker helpers, and authorized assessment can trigger this rule from monitored admin hosts. Confirm `process.executable`, Subject and Target identities, `host.id`, and explicit-credential or session records bind to the same workflow or validation scope; contradictory Target token details block benign closure.
 90- Build exceptions only from the minimum confirmed pattern, such as `process.executable` plus `winlog.event_data.SubjectUserSid`, `winlog.event_data.TargetUserSid`, and a bounded `host.id` or host group. Avoid exceptions on `process.name`, `user.name`, or the Target account alone.
 91
 92### Response and remediation
 93
 94- If confirmed benign, document the evidence categories, reverse temporary containment, and create only the narrow exception described above.
 95- If suspicious but unconfirmed, export the alert and surrounding Windows Security records, preserve the requesting process image and Subject-to-Target session context, and collect the referenced executable before containment.
 96- Apply reversible containment first: restrict the affected account or host session, increase monitoring on the involved `host.id` and identities, and weigh host criticality before isolation.
 97- If confirmed malicious, preserve the executable referenced by `process.executable`, session records, and Subject/Target identifiers, then contain involved hosts or accounts and invalidate active sessions.
 98- Reset or rotate Target credentials only when compromise or unauthorized use is supported; treat Subject as the operator or requesting context before disabling it.
 99- Eradicate only confirmed token-abuse tooling or credential material, review local privilege assignments that allowed the session, and retain Windows Security events needed to reconstruct Subject-to-Target token creation."""
100
101setup = """## Setup
102
103Audit Logon must be enabled to generate the events used by this rule.
104Setup instructions: https://ela.st/audit-logon
105"""
106
107[rule.investigation_fields]
108field_names = [
109    "@timestamp",
110    "host.id",
111    "process.name",
112    "process.executable",
113    "process.pid",
114    "winlog.logon.type",
115    "winlog.event_data.LogonProcessName",
116    "winlog.event_data.ImpersonationLevel",
117    "winlog.event_data.ElevatedToken",
118    "winlog.event_data.SubjectUserSid",
119    "winlog.event_data.SubjectUserName",
120    "winlog.event_data.SubjectLogonId",
121    "winlog.event_data.TargetUserSid",
122    "winlog.event_data.TargetLogonId",
123    "winlog.event_data.TargetLinkedLogonId",
124]
125
126[transform]
127
128[[transform.investigate]]
129label = "Explicit-credential events from the subject session"
130description = ""
131providers = [
132  [
133    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
134    { excluded = false, field = "event.code", queryType = "phrase", value = "4648", valueType = "string" },
135    { excluded = false, field = "winlog.event_data.SubjectLogonId", queryType = "phrase", value = "{{winlog.event_data.SubjectLogonId}}", valueType = "string" }
136  ]
137]
138relativeFrom = "now-1h"
139relativeTo = "now"
140
141[[transform.investigate]]
142label = "Target logon records for the created session"
143description = ""
144providers = [
145  [
146    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
147    { excluded = false, field = "event.code", queryType = "phrase", value = "4624", valueType = "string" },
148    { excluded = false, field = "winlog.event_data.TargetLogonId", queryType = "phrase", value = "{{winlog.event_data.TargetLogonId}}", valueType = "string" }
149  ]
150]
151relativeFrom = "now-1h"
152relativeTo = "now"
153
154[[transform.investigate]]
155label = "Target logoff records for the created session"
156description = ""
157providers = [
158  [
159    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
160    { excluded = false, field = "event.code", queryType = "phrase", value = "4634", valueType = "string" },
161    { excluded = false, field = "winlog.event_data.TargetLogonId", queryType = "phrase", value = "{{winlog.event_data.TargetLogonId}}", valueType = "string" }
162  ]
163]
164relativeFrom = "now-1h"
165relativeTo = "now"
166
167[[transform.investigate]]
168label = "Events for the created target logon session"
169description = ""
170providers = [
171  [
172    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
173    { excluded = false, field = "winlog.event_data.TargetLogonId", queryType = "phrase", value = "{{winlog.event_data.TargetLogonId}}", valueType = "string" }
174  ],
175  [
176    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
177    { excluded = false, field = "winlog.logon.id", queryType = "phrase", value = "{{winlog.event_data.TargetLogonId}}", valueType = "string" }
178  ]
179]
180relativeFrom = "now-1h"
181relativeTo = "now"
182
183[[transform.investigate]]
184label = "Alerts associated with the host"
185description = ""
186providers = [
187  [
188    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
189    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
190  ]
191]
192relativeFrom = "now-48h/h"
193relativeTo = "now"
194
195[[transform.investigate]]
196label = "Alerts associated with the subject identity"
197description = ""
198providers = [
199  [
200    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
201    { excluded = false, field = "winlog.event_data.SubjectUserSid", queryType = "phrase", value = "{{winlog.event_data.SubjectUserSid}}", valueType = "string" }
202  ],
203  [
204    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
205    { excluded = false, field = "user.id", queryType = "phrase", value = "{{winlog.event_data.SubjectUserSid}}", valueType = "string" }
206  ]
207]
208relativeFrom = "now-48h/h"
209relativeTo = "now"
210
211[[transform.investigate]]
212label = "Alerts associated with the target identity"
213description = ""
214providers = [
215  [
216    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
217    { excluded = false, field = "winlog.event_data.TargetUserSid", queryType = "phrase", value = "{{winlog.event_data.TargetUserSid}}", valueType = "string" }
218  ],
219  [
220    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
221    { excluded = false, field = "user.id", queryType = "phrase", value = "{{winlog.event_data.TargetUserSid}}", valueType = "string" }
222  ]
223]
224relativeFrom = "now-48h/h"
225relativeTo = "now"
226
227[[rule.threat]]
228framework = "MITRE ATT&CK"
229
230[[rule.threat.technique]]
231id = "T1134"
232name = "Access Token Manipulation"
233reference = "https://attack.mitre.org/techniques/T1134/"
234
235[[rule.threat.technique.subtechnique]]
236id = "T1134.002"
237name = "Create Process with Token"
238reference = "https://attack.mitre.org/techniques/T1134/002/"
239
240[[rule.threat.technique.subtechnique]]
241id = "T1134.003"
242name = "Make and Impersonate Token"
243reference = "https://attack.mitre.org/techniques/T1134/003/"
244
245[rule.threat.tactic]
246id = "TA0004"
247name = "Privilege Escalation"
248reference = "https://attack.mitre.org/tactics/TA0004/"