
title: Admin User Remote Logon
author: juju4
date: 2017/10/29
description: Detect remote login by Administrator user (depending on internal pattern).
detection:
  SELECTION_1:
    EventID: 4624
  SELECTION_2:
    LogonType: 10
  SELECTION_3:
    AuthenticationPackageName: Negotiate
  SELECTION_4:
    TargetUserName: Admin*
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3 and SELECTION_4)
falsepositives:
- Legitimate administrative activity.
id: 0f63e1ef-1eb9-4226-9d54-8927ca08520a
level: low
logsource:
  definition: 'Requirements: Identifiable administrators usernames (pattern or special
    unique character. ex: "Admin-*"), internal policy mandating use only as secondary
    account'
  product: windows
  service: security
modified: 2021/07/07
references:
- https://car.mitre.org/wiki/CAR-2016-04-005
status: experimental
tags:
- attack.lateral_movement
- attack.t1078
- attack.t1078.001
- attack.t1078.002
- attack.t1078.003
- car.2016-04-005
ruletype: SIGMA
