Windows Successful Logon Type 9 (NewCredentials) via Negotiate and Seclogo

Flags successful Windows NewCredentials (LogonType 9) logons using seclogo with Negotiate, consistent with Overpass-the-Hash behavior.

FreeUnreviewedSigmahighv1

windows-successful-logon-type-9-newcredentials-via-negotiate-and-seclogo-192a0330

title: Windows Successful Logon Type 9 (NewCredentials) via Negotiate and Seclogo
id: 231e0fdb-8fdd-48b1-8c0b-adbe8daa833d
status: test
description: This rule identifies successful Windows logons (EventID 4624) with LogonType 9 (NewCredentials) where the logon process is seclogo and the authentication package is Negotiate. This activity can indicate Overpass-the-Hash style credential usage for lateral movement without presenting the original password. It relies on Windows Security auditing for successful authentication events and their logon metadata fields.
references:
  - https://web.archive.org/web/20220419045003/https://cyberwardog.blogspot.com/2017/04/chronicles-of-threat-hunter-hunting-for.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_overpass_the_hash.yml
author: Roberto Rodriguez (source), Dominik Schaudel (rule), Huntrule Team
date: 2018-02-12
modified: 2021-11-27
tags:
  - attack.lateral-movement
  - attack.s0002
  - attack.t1550.002
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 9
    LogonProcessName: seclogo
    AuthenticationPackageName: Negotiate
  condition: selection
falsepositives:
  - Runas command-line tool using /netonly parameter
level: high
license: DRL-1.1
related:
  - id: 192a0330-c20b-4356-90b6-7b7049ae0b87
    type: derived

What it detects

This rule identifies successful Windows logons (EventID 4624) with LogonType 9 (NewCredentials) where the logon process is seclogo and the authentication package is Negotiate. This activity can indicate Overpass-the-Hash style credential usage for lateral movement without presenting the original password. It relies on Windows Security auditing for successful authentication events and their logon metadata fields.

Known false positives

Runas command-line tool using /netonly parameter

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.