title: Interactive Logon to Server Systems
id: 3ff152b2-1388-4984-9cd9-a323323fdadf
status: test
description: Detects interactive console logons to Server Systems
author: Florian Roth
date: 2017/03/17
modified: 2021/11/27
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 528
      - 529
      - 4624
      - 4625
    LogonType: 2
    ComputerName:
      - '%ServerSystems%'
      - '%DomainControllers%'
  filter:
    LogonProcessName: Advapi
    ComputerName: '%Workstations%'
  condition: selection and not filter
falsepositives:
  - Administrative activity via KVM or ILO board
level: medium
tags:
  - attack.lateral_movement
  - attack.t1078
