Windows Security: Admin Account Remote Logon (Event ID 4624 LogonType 10)

title: "Windows Security: Admin Account Remote Logon (Event ID 4624 LogonType 10)"
id: 2705cdb1-bf2c-4821-b4ad-1b0d9bedf908
status: test
description: This rule flags Windows Security Event ID 4624 where LogonType is 10 (remote logon) and the TargetUserName begins with “Admin”, using the Negotiate authentication package. Remote logons for administrative accounts are high-value opportunities for attackers and commonly support lateral movement or initial access paths. The detection relies on Windows logon telemetry (Event ID 4624) including LogonType, TargetUserName, and AuthenticationPackageName.
references:
  - https://car.mitre.org/wiki/CAR-2016-04-005
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_admin_rdp_login.yml
author: juju4, Huntrule Team
date: 2017-10-29
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.lateral-movement
  - attack.initial-access
  - attack.stealth
  - attack.t1078.001
  - attack.t1078.002
  - attack.t1078.003
  - car.2016-04-005
logsource:
  product: windows
  service: security
  definition: 'Requirements: Identifiable administrators usernames (pattern or special unique character. ex: "Admin-*"), internal policy mandating use only as secondary account'
detection:
  selection:
    EventID: 4624
    LogonType: 10
    AuthenticationPackageName: Negotiate
    TargetUserName|startswith: Admin
  condition: selection
falsepositives:
  - Legitimate administrative activity.
level: low
license: DRL-1.1
related:
  - id: 0f63e1ef-1eb9-4226-9d54-8927ca08520a
    type: derived