Admin User Remote Logon
Detect remote login by Administrator user (depending on internal pattern).
Sigma rule (View on GitHub)
1title: Admin User Remote Logon
2id: 0f63e1ef-1eb9-4226-9d54-8927ca08520a
3status: test
4description: Detect remote login by Administrator user (depending on internal pattern).
5references:
6 - https://car.mitre.org/wiki/CAR-2016-04-005
7author: juju4
8date: 2017-10-29
9modified: 2022-10-09
10tags:
11 - attack.lateral-movement
12 - attack.initial-access
13 - attack.t1078.001
14 - attack.t1078.002
15 - attack.t1078.003
16 - car.2016-04-005
17logsource:
18 product: windows
19 service: security
20 definition: 'Requirements: Identifiable administrators usernames (pattern or special unique character. ex: "Admin-*"), internal policy mandating use only as secondary account'
21detection:
22 selection:
23 EventID: 4624
24 LogonType: 10
25 AuthenticationPackageName: Negotiate
26 TargetUserName|startswith: 'Admin'
27 condition: selection
28falsepositives:
29 - Legitimate administrative activity.
30level: low
References
Related rules
- Root Account Enable Via Dsenableroot
- OpenCanary - SSH Login Attempt
- OpenCanary - SSH New Connection Attempt
- AWS Suspicious SAML Activity
- Apache Threading Error