Potentially Suspicious Explicit Credential Local Logon

calendar Aug 3, 2026 · attack.privilege-escalation attack.stealth attack.t1134 attack.t1134.003  ·
Share on: linkedin copy

Detects potentially suspicious explicit credential logon events where the user is trying to logon with explicit credentials (username and password) that are different from the current user context. It might indicate an attacker attempting to escalate privileges after obtaining credentials for a different user account.

Sigma rule (View on GitHub)

 1title: Potentially Suspicious Explicit Credential Local Logon
 2id: e3c6d245-7b8f-4e2a-c17f-a9d0e5b38f62
 3status: experimental
 4description: |
 5    Detects potentially suspicious explicit credential logon events where the user
 6    is trying to logon with explicit credentials (username and password) that are
 7    different from the current user context. It might indicate an attacker attempting
 8    to escalate privileges after obtaining credentials for a different user account.    
 9references:
10    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648
11    - https://github.com/MSNightmare/LegacyHive
12author: Swachchhanda Shrawan Poudel (Nextron Systems)
13date: 2026-07-23
14tags:
15    - attack.privilege-escalation
16    - attack.stealth
17    - attack.t1134
18    - attack.t1134.003
19logsource:
20    product: windows
21    service: security
22detection:
23    selection_eid:
24        EventID: 4648
25    selection_localhost:
26        - TargetServerName: 'localhost'
27        - TargetInfo: 'localhost'
28        - IpAddress:
29              - '127.0.0.1'
30              - '::1'
31    filter_main_computer_accounts:
32        SubjectUserName|endswith: '$'
33    filter_main_system_processes:
34        ProcessName|startswith:
35            - 'C:\Windows\System32\'
36            - 'C:\Windows\SysWOW64\'
37            - 'C:\Windows\WinSxS\'
38    filter_main_program_files:
39        ProcessName|startswith:
40            - 'C:\Program Files\'
41            - 'C:\Program Files (x86)\'
42    filter_main_same_user:
43        SubjectUserName|fieldref: TargetUserName
44    condition: all of selection_* and not 1 of filter_main_*
45falsepositives:
46    - RunAs usage from user-installed applications outside Program Files
47    - Administrative scripts using explicit credentials from non-standard paths
48level: medium
49regression_tests_path: regression_data/rules/windows/builtin/security/win_security_explicit_credential_local_logon/info.yml

References

Related rules

to-top