RULER Tool Activity on Windows Security: Event 4776 and 4624/4625

title: "RULER Tool Activity on Windows Security: Event 4776 and 4624/4625"
id: fb25a329-f27a-40d6-8368-a3f0f3c543b8
status: test
description: This rule flags Windows Security events associated with the Workstation value 'RULER' during NTLM authentication activity. It looks for Event ID 4776 (with Workstation 'RULER') and correlates it with logon successes and failures (Event IDs 4624 and 4625) where WorkstationName is also 'RULER'. Such activity matters because it can indicate credential capture or discovery workflows performed by an operator using the Ruler tool. The rule relies on Windows Security telemetry for Event IDs 4776, 4624, and 4625 along with workstation identifiers.
references:
  - https://github.com/sensepost/ruler
  - https://github.com/sensepost/ruler/issues/47
  - https://github.com/staaldraad/go-ntlm/blob/cd032d41aa8ce5751c07cb7945400c0f5c81e2eb/ntlm/ntlmv1.go#L427
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4624
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_alert_ruler.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-05-31
modified: 2022-10-09
tags:
  - attack.discovery
  - attack.execution
  - attack.collection
  - attack.lateral-movement
  - attack.t1087
  - attack.t1114
  - attack.t1059
  - attack.t1550.002
logsource:
  product: windows
  service: security
detection:
  selection1:
    EventID: 4776
    Workstation: RULER
  selection2:
    EventID:
      - 4624
      - 4625
    WorkstationName: RULER
  condition: (1 of selection*)
falsepositives:
  - Go utilities that use staaldraad awesome NTLM library
level: high
license: DRL-1.1
related:
  - id: 24549159-ac1b-479c-8175-d42aea947cae
    type: derived