Windows Security: Detects RULER workstation using NTLM and login events (Event IDs 4776, 4624/4625)

Alerts when RULER-labeled Windows Security events show NTLM auth (4776) plus 4624/4625 logons.

FreeReviewedSigma · High · v2

Product: windows
Service: security
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2017-05-31
Updated: 2026-07-31

ATT&CK techniques

Execution → Collection

Recon
Resource Dev
Initial Access
Execution
- T1059Command and Scripting Interpreter
Persistence
Priv Esc
Defense Evasion
- T1550.002Pass the Hash
Cred Access
Discovery
- T1087Account Discovery
Lateral Movement
- T1550.002Pass the Hash
Collection
- T1114Email Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows Security audit activity associated with the RULER workstation, combining NTLM authentication processing (Event ID 4776) with subsequent logon success/failure events (Event IDs 4624 and 4625) that also reference RULER. Such activity can indicate use of an offensive NTLM-focused tooling workflow for authentication testing or credential interaction. It relies on Windows Security logs containing Event IDs 4776, 4624, and/or 4625 and matching the workstation/workstation name fields to RULER.

Reporting behind it

Related detections9 linkedT1059 — drag to rearrange

Malicious Web Server Process Spawning Command Interpreter via Web Shell (via process_creation)

Suspicious VMware Guest Operation Output Staging in vmware-system Temp Directory (via file_event)

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

Suspicious OWA Proxy User-Agent Indicating Mailbox Access

Suspicious Script Interpreter Spawned by Excel via DarkGate Lure

Suspicious AutoHotkey Script Execution from User Writable Path by DarkGate

Suspicious ROADtools User Agent Against Microsoft Graph (via azure)

Possible Pass-the-Hash NTLM Network Logon (via security)

Malicious China Chopper Web Shell Command Pattern in IIS Worker Process (via process_creation)

Windows Security: Detects RULER workstation using NTLM and login events (Event IDs 4776, 4624/4625)

Pivot detection · T1059 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

ruler-tool-activity-on-windows-security-event-4776-and-4624-4625-24549159

title: "Windows Security: Detects RULER workstation using NTLM and login events (Event IDs 4776, 4624/4625)"
id: fb25a329-f27a-40d6-8368-a3f0f3c543b8
status: test
description: This rule flags Windows Security audit activity associated with the RULER workstation, combining NTLM authentication processing (Event ID 4776) with subsequent logon success/failure events (Event IDs 4624 and 4625) that also reference RULER. Such activity can indicate use of an offensive NTLM-focused tooling workflow for authentication testing or credential interaction. It relies on Windows Security logs containing Event IDs 4776, 4624, and/or 4625 and matching the workstation/workstation name fields to RULER.
references:
  - https://github.com/sensepost/ruler
  - https://github.com/sensepost/ruler/issues/47
  - https://github.com/staaldraad/go-ntlm/blob/cd032d41aa8ce5751c07cb7945400c0f5c81e2eb/ntlm/ntlmv1.go#L427
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4624
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_alert_ruler.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-05-31
modified: 2022-10-09
tags:
  - attack.discovery
  - attack.execution
  - attack.collection
  - attack.lateral-movement
  - attack.t1087
  - attack.t1114
  - attack.t1059
  - attack.t1550.002
logsource:
  product: windows
  service: security
detection:
  selection1:
    EventID: 4776
    Workstation: RULER
  selection2:
    EventID:
      - 4624
      - 4625
    WorkstationName: RULER
  condition: (1 of selection*)
falsepositives:
  - Go utilities that use staaldraad awesome NTLM library
level: high
license: DRL-1.1
related:
  - id: 24549159-ac1b-479c-8175-d42aea947cae
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL