Windows Security: Anonymous Logon (4624 LogonType 3) with Loopback IPs
Alerts on Windows 4624 LogonType 3 with ANONYMOUS LOGON and loopback IPs, matching RottenPotato-like patterns.
- Product
- windows
- Service
- security
- Author
- @SBousseaden, Florian Roth (SigmaHQ), DRL 1.1
- Published
- 2019-11-15
- Updated
- 2026-07-31
ATT&CK techniques
Cred Access → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
C2
Exfiltration
Impact
What it detects
This rule flags Windows Security logon events (EventID 4624) where the logon is an anonymous logon with LogonType 3, and the source IP is loopback (127.0.0.1 or ::1). This pattern is used by credential/privilege escalation techniques that generate atypical authentication events via local interactions rather than external clients. It relies on Windows Security auditing fields including TargetUserName, LogonType, WorkstationName, and IpAddress to identify the behavior.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security: Anonymous Logon (4624 LogonType 3) with Loopback IPs"
id: ffaf95b1-2b2a-43a2-b051-13ae53cb70bd
status: test
description: This rule flags Windows Security logon events (EventID 4624) where the logon is an anonymous logon with LogonType 3, and the source IP is loopback (127.0.0.1 or ::1). This pattern is used by credential/privilege escalation techniques that generate atypical authentication events via local interactions rather than external clients. It relies on Windows Security auditing fields including TargetUserName, LogonType, WorkstationName, and IpAddress to identify the behavior.
references:
- https://twitter.com/SBousseaden/status/1195284233729777665
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_susp_rottenpotato.yml
author: "@SBousseaden, Florian Roth, Huntrule Team"
date: 2019-11-15
modified: 2022-12-22
tags:
- attack.collection
- attack.privilege-escalation
- attack.credential-access
- attack.t1557.001
logsource:
product: windows
service: security
detection:
selection:
EventID: 4624
LogonType: 3
TargetUserName: ANONYMOUS LOGON
WorkstationName: "-"
IpAddress:
- 127.0.0.1
- ::1
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 16f5d8ca-44bd-47c8-acbe-6fc95a16c12f
type: derived