
title: Suspicious Remote Logon with Explicit Credentials
author: oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st
date: 2020/10/05
description: Detects suspicious processes logging on with explicit credentials
detection:
  SELECTION_1:
    EventID: 4648
  SELECTION_2:
    ProcessName:
    - '*\cmd.exe'
    - '*\powershell.exe'
    - '*\pwsh.exe'
    - '*\winrs.exe'
    - '*\wmic.exe'
    - '*\net.exe'
    - '*\net1.exe'
    - '*\reg.exe'
  SELECTION_3:
    TargetServerName: localhost
  condition: ((SELECTION_1 and SELECTION_2) and  not (SELECTION_3))
falsepositives:
- Administrators that use the RunAS command or scheduled tasks
id: 941e5c45-cda7-4864-8cea-bbb7458d194a
level: medium
logsource:
  product: windows
  service: security
modified: 2021/11/12
references:
- https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view
status: experimental
tags:
- attack.t1078
- attack.lateral_movement
ruletype: SIGMA
