huntrule

Windows Security: Anonymous Logon (4624 LogonType 3) with Loopback IPs

Alerts on Windows 4624 LogonType 3 with ANONYMOUS LOGON and loopback IPs, matching RottenPotato-like patterns.

FreeReviewedSigma · High · v2
Product
windows
Service
security
Author
@SBousseaden, Florian Roth (SigmaHQ), DRL 1.1
Published
2019-11-15
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Cred Access → Collection

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows Security logon events (EventID 4624) where the logon is an anonymous logon with LogonType 3, and the source IP is loopback (127.0.0.1 or ::1). This pattern is used by credential/privilege escalation techniques that generate atypical authentication events via local interactions rather than external clients. It relies on Windows Security auditing fields including TargetUserName, LogonType, WorkstationName, and IpAddress to identify the behavior.

Reporting behind it

Related detections9 linkedT1557.001 — drag to rearrange
Suspicious LLMNR and NBT-NS Poisoning Tooling via ALPHA SPIDER (via process_creation)
Masquerading Exchange Server Impersonation via PrivExchange Relay Attack (via security)
Windows Process Creation: Command-Line Kerberos Coercion Signature via DNS SPN Spoofing
Zeek DNS detects base64 credential target pattern consistent with Kerberos DNS object spoofing
Windows DNS Query with Kerberos Coercion Signature via DNS Object SPN Spoofing
Windows LPE Attempt via TabTip CLSID Using Microsoft-Windows-DistributedCOM (Event ID 10001)
Zeek DCE/RPC efs* Operations Indicative of EFS Remote Protocol Use
Windows Process Creation: ADCSPwn Command-Line Parameters Indicating ADCS Abuse
Windows WinDivert Driver Load via Image or Known IMPHASHes
Windows Security: Anonymous Logon (4624 LogonType 3) with Loopback IPs
Pivot detection · T1557.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.