Windows Security Event 4611: New Trusted Logon Process via User32LogonProcesss

title: "Windows Security Event 4611: New Trusted Logon Process via User32LogonProcesss"
id: 6fac1482-3f2d-4ffd-ba4f-c8619acf7e70
status: test
description: This rule flags Windows Security Event ID 4611 when a new logon process is registered with the LogonProcessName value 'User32LogonProcesss'. Attackers can abuse registered logon processes to enable credential or session-related abuse, making this registration event a useful indicator of suspicious activity. The detection relies on Windows Security audit telemetry capturing EventID 4611 and the associated LogonProcessName field.
references:
  - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_register_new_logon_process_by_rubeus.yml
author: Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community, Huntrule Team
date: 2019-10-24
modified: 2022-10-09
tags:
  - attack.lateral-movement
  - attack.privilege-escalation
  - attack.credential-access
  - attack.t1558.003
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4611
    LogonProcessName: User32LogonProcesss
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 12e6d621-194f-4f59-90cc-1959e21e69f7
    type: derived