Sigma rule: Potentially Suspicious Explicit Credential Local Logon

Rule

Title

Potentially Suspicious Explicit Credential Local Logon

Status

experimental

Level

medium

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-07-23

File

rules/windows/builtin/security/win_security_explicit_credential_local_logon.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potentially suspicious explicit credential logon events where the user
is trying to logon with explicit credentials (username and password) that are
different from the current user context. It might indicate an attacker attempting
to escalate privileges after obtaining credentials for a different user account.

Log source

product

windows

service

security

Detection

selection_eid:
    EventID: 4648
selection_localhost:
    - TargetServerName: 'localhost'
    - TargetInfo: 'localhost'
    - IpAddress:
          - '127.0.0.1'
          - '::1'
filter_main_computer_accounts:
    SubjectUserName|endswith: '$'
filter_main_system_processes:
    ProcessName|startswith:
        - 'C:\Windows\System32\'
        - 'C:\Windows\SysWOW64\'
        - 'C:\Windows\WinSxS\'
filter_main_program_files:
    ProcessName|startswith:
        - 'C:\Program Files\'
        - 'C:\Program Files (x86)\'
filter_main_same_user:
    SubjectUserName|fieldref: TargetUserName
condition: all of selection_* and not 1 of filter_main_*

False positives (as the rule lists them)

• RunAs usage from user-installed applications outside Program Files
• Administrative scripts using explicit credentials from non-standard paths

Tags

• attack.privilege-escalation
• attack.stealth
• attack.t1134
• attack.t1134.003

MITRE ATT&CK ids this rule names

• T1134
• T1134.003

References

• https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648
• https://github.com/MSNightmare/LegacyHive

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/win_security_explicit_credential_local_logon.yml