Sigma rule: User with Privileges Logon

Rule

Title

User with Privileges Logon

Status

test

Level

low

Author

frack113

Date

2022-10-14

Modified

2023-12-14

File

rules-placeholder/windows/builtin/security/win_security_admin_logon.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects logon with "Special groups" and "Special Privileges" can be thought of as Administrator groups or privileges.

Log source

product

windows

service

security

Detection

selection:
    EventID:
        - 4672
        - 4964
filter_main_local_system:
    SubjectUserSid: 'S-1-5-18'
filter_main_valid_account:
    SubjectUserName|expand: '%Admins_Workstations%' # Set valid internal naming pattern or a list a valid account
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.lateral-movement
• attack.credential-access
• attack.t1558
• attack.t1649
• attack.t1550

MITRE ATT&CK ids this rule names

• T1550
• T1558
• T1649

References

• https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md
• https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4672
• https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4964

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-placeholder/windows/builtin/security/win_security_admin_logon.yml