detection.wiki

Detection rules › Sigma

RottenPotato Like Attack Pattern

Severity
high
Author
@SBousseaden, Florian Roth
Source
upstream

Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
CollectionT1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay

Event coverage

ProviderEvent IDTitle
Security-Auditing4624An account was successfully logged on.

Stages and Predicates

Stage 1: selection

IpAddress: [127.0.0.1, '::1']
LogonType: 3
TargetUserName: 'ANONYMOUS LOGON'
WorkstationName: -

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
IpAddresseq
  • 127.0.0.1 corpus 5 (sigma 5)
  • ::1 corpus 5 (sigma 5)
LogonTypeeq
  • 3 corpus 12 (splunk 7, sigma 5)
TargetUserNameeq
  • ANONYMOUS LOGON corpus 3 (sigma 3)
WorkstationNameeq
  • -

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.