Detection rules › Sigma

Suspicious Remote Logon with Explicit Credentials

Severity
medium
Author
oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Tim Shelton
Source
upstream

Detects suspicious processes logging on with explicit credentials

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1078 Valid Accounts
PersistenceT1078 Valid Accounts
Privilege EscalationT1078 Valid Accounts
Defense EvasionT1078 Valid Accounts

Event coverage

ProviderEvent IDTitle
Security-Auditing4648A logon was attempted using explicit credentials.

Stages and Predicates

Stage 1: selection

or:
ProcessName|endswith: '\cmd.exe'
ProcessName|endswith: '\net.exe'
ProcessName|endswith: '\net1.exe'
ProcessName|endswith: '\powershell.exe'
ProcessName|endswith: '\pwsh.exe'
ProcessName|endswith: '\reg.exe'
ProcessName|endswith: '\winrs.exe'
ProcessName|endswith: '\wmic.exe'

Stage 2: not 1 of filter*

or:
SubjectUserName|endswith: '$'
TargetUserName|endswith: '$'
TargetServerName: localhost

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ProcessNameends_with
  • \cmd.exe
  • \net.exe
  • \net1.exe
  • \powershell.exe
  • \pwsh.exe
  • \reg.exe
  • \winrs.exe
  • \wmic.exe
SubjectUserNameends_with
  • $ corpus 18 (sigma 14, elastic 4)
TargetServerNameeq
  • localhost
TargetUserNameends_with
  • $ corpus 18 (sigma 14, elastic 4)