Admin User Remote Logon
Detect remote login by Administrator user (depending on internal pattern).
Sigma rule (View on GitHub)
1title: Admin User Remote Logon
2id: 0f63e1ef-1eb9-4226-9d54-8927ca08520a
3status: test
4description: Detect remote login by Administrator user (depending on internal pattern).
5references:
6 - https://car.mitre.org/wiki/CAR-2016-04-005
7author: juju4
8date: 2017-10-29
9modified: 2022-10-09
10tags:
11 - attack.privilege-escalation
12 - attack.persistence
13 - attack.defense-evasion
14 - attack.lateral-movement
15 - attack.initial-access
16 - attack.t1078.001
17 - attack.t1078.002
18 - attack.t1078.003
19 - car.2016-04-005
20logsource:
21 product: windows
22 service: security
23 definition: 'Requirements: Identifiable administrators usernames (pattern or special unique character. ex: "Admin-*"), internal policy mandating use only as secondary account'
24detection:
25 selection:
26 EventID: 4624
27 LogonType: 10
28 AuthenticationPackageName: Negotiate
29 TargetUserName|startswith: 'Admin'
30 condition: selection
31falsepositives:
32 - Legitimate administrative activity.
33level: low
References
Related rules
- Root Account Enable Via Dsenableroot
- AWS Suspicious SAML Activity
- Commvault QLogin with PublicSharingUser and GUID Password (CVE-2025-57788)
- Guest Account Enabled Via Sysadminctl
- Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure