huntrule

Windows NetLogon Secure Channel Connection Allowed for Vulnerable Client

Alerts on Windows NetLogon ETW events indicating an allowed secure channel connection (Event ID 5829).

FreeReviewedSigma · High · v2
Product
windows
Service
system
Author
NVISO (SigmaHQ), DRL 1.1
Published
2020-09-15
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Priv Esc → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows System events where the NetLogon provider reports EventID 5829 indicating a secure channel connection was allowed. Attackers can leverage vulnerable Netlogon secure channel behavior to facilitate privilege escalation attempts, so spotting allowed connections is important for early investigation. It relies on Windows system telemetry from the NetLogon provider capturing EventID 5829 and the Provider_Name value.

Reporting behind it

Related detections9 linkedT1548 — drag to rearrange
Malicious Sapphire Sleet TCC Privacy Database Tampering via sqlite3 (via process_creation)
Suspicious storagekitd Spawning Third-Party Filesystem Binary from Library Filesystems (via process_creation)
Malicious Switch User to Rogue Root-Equivalent Account troot (via process_creation)
Suspicious Sang Loader Execution with Install or PassUAC Arguments
Possible GTFOBins Shell Breakout via Unix Utilities
Malicious Azure Elevate Access to User Access Administrator
Suspicious User Home Directory Modification via dscl Process Creation
Possible GTFOBins Shell Breakout via apt Command
Malicious Update Orchestrator Service Reconfiguration for Privilege Escalation
Windows NetLogon Secure Channel Connection Allowed for Vulnerable Client
Pivot detection · T1548 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.