Windows Security 4624 Logon Type 3: Anonymous local IP (RottenPotato-like) pattern

title: "Windows Security 4624 Logon Type 3: Anonymous local IP (RottenPotato-like) pattern"
id: ffaf95b1-2b2a-43a2-b051-13ae53cb70bd
status: test
description: This rule flags Windows Security logon events (EventID 4624) with LogonType 3 where the TargetUserName is "ANONYMOUS LOGON" and the workstation is "-". It further requires the source IP to be local loopback addresses (127.0.0.1 or ::1), a combination commonly seen in RottenPotato-like behaviors. This matters because such local, anomalous authentication patterns can indicate attempted credential access and privilege escalation, and it relies on Windows Security audit telemetry fields for event ID, logon type, target user, workstation name, and source IP.
references:
  - https://twitter.com/SBousseaden/status/1195284233729777665
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_susp_rottenpotato.yml
author: "@SBousseaden, Florian Roth, Huntrule Team"
date: 2019-11-15
modified: 2022-12-22
tags:
  - attack.collection
  - attack.privilege-escalation
  - attack.credential-access
  - attack.t1557.001
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 3
    TargetUserName: ANONYMOUS LOGON
    WorkstationName: "-"
    IpAddress:
      - 127.0.0.1
      - ::1
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 16f5d8ca-44bd-47c8-acbe-6fc95a16c12f
    type: derived