huntrule

Windows NetLogon Secure Channel Connection Allowed for Vulnerable Client

Alerts on Windows NetLogon ETW events indicating an allowed secure channel connection (Event ID 5829).

FreeReviewedSigma · High · v2
Product
windows
Service
system
Author
NVISO (SigmaHQ), DRL 1.1
Published
2020-09-15
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Priv Esc → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows System events where the NetLogon provider reports EventID 5829 indicating a secure channel connection was allowed. Attackers can leverage vulnerable Netlogon secure channel behavior to facilitate privilege escalation attempts, so spotting allowed connections is important for early investigation. It relies on Windows system telemetry from the NetLogon provider capturing EventID 5829 and the Provider_Name value.

Reporting behind it

Related detections9 linkedT1548 — drag to rearrange
Malicious Azure Elevate Access to User Access Administrator
Suspicious User Home Directory Modification via dscl Process Creation
Possible GTFOBins Shell Breakout via apt Command
Malicious Update Orchestrator Service Reconfiguration for Privilege Escalation
Malicious macOS Credential Verification via dscl authonly
Malicious setcap Assigning cap_sys_admin for GameOverlay Privilege Escalation (via process_creation)
Suspicious AWS GetFederationToken Console Access by JavaGhost (via cloudtrail)
Linux: Detect changes to fs.suid_dumpable enabling core dumps for SUID processes
Linux setcap sets cap_setgid on binaries (Setgid capability assignment)
Windows NetLogon Secure Channel Connection Allowed for Vulnerable Client
Pivot detection · T1548 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.