Windows Security: DiagTrackEoP Default Logon Username (EventID 4624, LogonType 9)

Alerts on Windows 4624 LogonType 9 events targeting a known DiagTrackEoP default username.

FreeUnreviewedSigmacriticalv1

windows-security-diagtrackeop-default-logon-username-eventid-4624-logontype-9-2111118f

title: "Windows Security: DiagTrackEoP Default Logon Username (EventID 4624, LogonType 9)"
id: 9c8d8ef4-d922-442b-b6eb-dc4a1d8b4824
status: test
description: This rule flags Windows Security log entries where a logon with LogonType 9 (throughout) targets the specific username value 'thisisnotvaliduser'. Attackers may rely on known default credentials or proof-of-concept behavior to trigger authentication and subsequent actions during privilege escalation attempts. The detection relies on Windows EventID 4624 and the associated target outbound username field in Security auditing telemetry.
references:
  - https://github.com/Wh04m1001/DiagTrackEoP/blob/3a2fc99c9700623eb7dc7d4b5f314fd9ce5ef51f/main.cpp#L46
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_diagtrack_eop_default_login_username.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-03
tags:
  - attack.privilege-escalation
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 9
    TargetOutboundUserName: thisisnotvaliduser
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 2111118f-7e46-4fc8-974a-59fd8ec95196
    type: derived

What it detects

This rule flags Windows Security log entries where a logon with LogonType 9 (throughout) targets the specific username value 'thisisnotvaliduser'. Attackers may rely on known default credentials or proof-of-concept behavior to trigger authentication and subsequent actions during privilege escalation attempts. The detection relies on Windows EventID 4624 and the associated target outbound username field in Security auditing telemetry.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.