Sigma rule: Suspicious Remote Logon with Explicit Credentials

Rule

Title

Suspicious Remote Logon with Explicit Credentials

Status

test

Level

medium

Author

oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Tim Shelton

Date

2020-10-05

Modified

2022-08-03

File

rules/windows/builtin/security/win_security_susp_logon_explicit_credentials.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious processes logging on with explicit credentials

Log source

product

windows

service

security

Detection

selection:
    EventID: 4648
    ProcessName|endswith:
        - '\cmd.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\winrs.exe'
        - '\wmic.exe'
        - '\net.exe'
        - '\net1.exe'
        - '\reg.exe'
filter1:
    TargetServerName: 'localhost'
filter2:
    SubjectUserName|endswith: '$'
    TargetUserName|endswith: '$'
condition: selection and not 1 of filter*

False positives (as the rule lists them)

• Administrators that use the RunAS command or scheduled tasks

Tags

• attack.privilege-escalation
• attack.persistence
• attack.initial-access
• attack.stealth
• attack.t1078
• attack.lateral-movement

MITRE ATT&CK ids this rule names

• T1078

References

• https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/win_security_susp_logon_explicit_credentials.yml