Windows Security: Detects RULER workstation using NTLM and login events (Event IDs 4776, 4624/4625)
Alerts when RULER-labeled Windows Security events show NTLM auth (4776) plus 4624/4625 logons.
- Product
- windows
- Service
- security
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2017-05-31
- Updated
- 2026-07-31
ATT&CK techniques
Execution → CollectionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows Security audit activity associated with the RULER workstation, combining NTLM authentication processing (Event ID 4776) with subsequent logon success/failure events (Event IDs 4624 and 4625) that also reference RULER. Such activity can indicate use of an offensive NTLM-focused tooling workflow for authentication testing or credential interaction. It relies on Windows Security logs containing Event IDs 4776, 4624, and/or 4625 and matching the workstation/workstation name fields to RULER.
Reporting behind it
- github.comhttps://github.com/sensepost/ruler
- github.comhttps://github.com/sensepost/ruler/issues/47
- github.comhttps://github.com/staaldraad/go-ntlm/blob/cd032d41aa8ce5751c07cb7945400c0f5c81e2eb/ntlm/ntlmv1.go#L427
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4624
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_alert_ruler.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security: Detects RULER workstation using NTLM and login events (Event IDs 4776, 4624/4625)"
id: fb25a329-f27a-40d6-8368-a3f0f3c543b8
status: test
description: This rule flags Windows Security audit activity associated with the RULER workstation, combining NTLM authentication processing (Event ID 4776) with subsequent logon success/failure events (Event IDs 4624 and 4625) that also reference RULER. Such activity can indicate use of an offensive NTLM-focused tooling workflow for authentication testing or credential interaction. It relies on Windows Security logs containing Event IDs 4776, 4624, and/or 4625 and matching the workstation/workstation name fields to RULER.
references:
- https://github.com/sensepost/ruler
- https://github.com/sensepost/ruler/issues/47
- https://github.com/staaldraad/go-ntlm/blob/cd032d41aa8ce5751c07cb7945400c0f5c81e2eb/ntlm/ntlmv1.go#L427
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4624
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_alert_ruler.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-05-31
modified: 2022-10-09
tags:
- attack.discovery
- attack.execution
- attack.collection
- attack.lateral-movement
- attack.t1087
- attack.t1114
- attack.t1059
- attack.t1550.002
logsource:
product: windows
service: security
detection:
selection1:
EventID: 4776
Workstation: RULER
selection2:
EventID:
- 4624
- 4625
WorkstationName: RULER
condition: (1 of selection*)
falsepositives:
- Go utilities that use staaldraad awesome NTLM library
level: high
license: DRL-1.1
related:
- id: 24549159-ac1b-479c-8175-d42aea947cae
type: derived