Windows Suspicious Remote Logon Using Explicit Credentials

title: Windows Suspicious Remote Logon Using Explicit Credentials
id: a3610b8c-a464-46fb-a132-10adf03836d5
status: test
description: Identifies Windows Security EventID 4648 sessions where the initiating process is a command-line or management utility (cmd.exe, PowerShell, pwsh, winrs, wmic, net, reg), indicating a remote logon request using explicit credentials. This behavior can help an attacker establish authenticated access for lateral movement or initial access while avoiding normal interactive logons. The rule relies on EventID 4648 telemetry and process name matching from Windows Security auditing.
references:
  - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_logon_explicit_credentials.yml
author: oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Tim Shelton, Huntrule Team
date: 2020-10-05
modified: 2022-08-03
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078
  - attack.lateral-movement
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4648
    ProcessName|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
      - \winrs.exe
      - \wmic.exe
      - \net.exe
      - \net1.exe
      - \reg.exe
  filter1:
    TargetServerName: localhost
  filter2:
    SubjectUserName|endswith: $
    TargetUserName|endswith: $
  condition: selection and not 1 of filter*
falsepositives:
  - Administrators that use the RunAS command or scheduled tasks
level: medium
license: DRL-1.1
related:
  - id: 941e5c45-cda7-4864-8cea-bbb7458d194a
    type: derived