Windows System: Netlogon Secure Channel Connection Allowed (Event ID 5829)

title: "Windows System: Netlogon Secure Channel Connection Allowed (Event ID 5829)"
id: d37efaf2-cbac-4426-8656-0702a9a94481
status: test
description: This rule flags Windows System events where the NetLogon provider reports a secure channel connection was allowed (Event ID 5829). Allowing a vulnerable Netlogon secure channel can enable authentication-related attacks that may lead to privilege escalation, so surfacing these events helps identify risky system exposure. Detection relies on Windows ETW telemetry from the NetLogon provider captured in the System event stream.
references:
  - https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/netlogon/win_system_vul_cve_2020_1472.yml
author: NVISO, Huntrule Team
date: 2020-09-15
modified: 2022-12-25
tags:
  - attack.privilege-escalation
  - attack.t1548
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: NetLogon
    EventID: 5829
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a0cb7110-edf0-47a4-9177-541a4083128a
    type: derived