Windows Rapid Authentication On Multiple Hosts

Author: Mauricio Velazco, Splunk
Source: upstream

The following analytic detects a source computer authenticating to 30 or more remote endpoints within a 5-minute timespan using Event ID 4624. This behavior is identified by analyzing Windows Event Logs for LogonType 3 events and counting unique target computers. Such activity is significant as it may indicate lateral movement or network share enumeration by an adversary. If confirmed malicious, this could lead to unauthorized access to multiple systems, potentially compromising sensitive data and escalating privileges within the network.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.002` OS Credential Dumping: Security Account Manager

Event coverage

Provider	Event ID	Title
Security-Auditing	4624	An account was successfully logged on.

Stages and Predicates

Stage 1: `search`

search EventCode=4624 LogonType=3 TargetUserName!="*$" TargetUserName!="ANONYMOUS LOGON"

Stage 2: `bucket`

bucket span=5m _time

Stage 3: `stats`

stats dc(Computer) AS unique_targets, … AS host_targets, … AS dest, … AS src, … AS user BY _time, IpAddress, TargetUserName, action, app, authentication_method, signature, signature_id

Stage 4: `where`

where unique_targets>30

Stage 5: `search`

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`EventCode`	eq	`4624` corpus 6 (splunk 6)
`LogonType`	eq	`3` corpus 12 (splunk 7, sigma 5)
`TargetUserName`	ne	`"*$"` corpus 7 (splunk 7) `"ANONYMOUS LOGON"`
`unique_targets`	gt	`30` corpus 5 (splunk 5)

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.

Potential Account Takeover - Mixed Logon Types [elastic] (cross-vendor) (drops 4 filters this rule applies) (first-stage match only; downstream stages may differ)
Potential Account Takeover - Logon from New Source IP [elastic] (cross-vendor) (drops 4 filters this rule applies) (first-stage match only; downstream stages may differ)
External Remote SMB Logon from Public IP [sigma] (cross-vendor) (drops 3 filters this rule applies) (first-stage match only; downstream stages may differ)
Unusual Number of Remote Endpoint Authentication Events [splunk] (drops 1 filter this rule applies) (first-stage match only; downstream stages may differ)