{"id":"941e5c45-cda7-4864-8cea-bbb7458d194a","title":"Suspicious Remote Logon with Explicit Credentials","description":"Detects suspicious processes logging on with explicit credentials","author":"oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Tim Shelton","status":"test","level":"medium","date":"2020-10-05","modified":"2022-08-03","tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.stealth","attack.t1078","attack.lateral-movement"],"technique_ids":["T1078"],"logsource":{"product":"windows","service":"security"},"falsepositives":["Administrators that use the RunAS command or scheduled tasks"],"references":["https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view"],"source_path":"rules/windows/builtin/security/win_security_susp_logon_explicit_credentials.yml","source_sha256":"4297249a4b2573cb0d3797b5ce9d04d7dc43927c8aca0d20f94966c4e7adeb13","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_susp_logon_explicit_credentials.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Remote Logon with Explicit Credentials\nid: 941e5c45-cda7-4864-8cea-bbb7458d194a\nstatus: test\ndescription: Detects suspicious processes logging on with explicit credentials\nreferences:\n    - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view\nauthor: oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Tim Shelton\ndate: 2020-10-05\nmodified: 2022-08-03\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.initial-access\n    - attack.stealth\n    - attack.t1078\n    - attack.lateral-movement\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4648\n        ProcessName|endswith:\n            - '\\cmd.exe'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n            - '\\winrs.exe'\n            - '\\wmic.exe'\n            - '\\net.exe'\n            - '\\net1.exe'\n            - '\\reg.exe'\n    filter1:\n        TargetServerName: 'localhost'\n    filter2:\n        SubjectUserName|endswith: '$'\n        TargetUserName|endswith: '$'\n    condition: selection and not 1 of filter*\nfalsepositives:\n    - Administrators that use the RunAS command or scheduled tasks\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1078","id":"T1078","name":"Valid Accounts","page":"techniques/enterprise/T1078/"}],"data_path":"data/detection-rules/941e5c45-cda7-4864-8cea-bbb7458d194a.json","kind":"sigma"}