rules/windows/builtin/security/win_susp_interactive_logons.yml

title: Interactive Logon to Server Systems
id: 3ff152b2-1388-4984-9cd9-a323323fdadf
status: test
description: Detects interactive console logons to Server Systems
author: Florian Roth
date: 2017/03/17
modified: 2021/11/27
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 528
      - 529
      - 4624
      - 4625
    LogonType: 2
    ComputerName:
      - '%ServerSystems%'
      - '%DomainControllers%'
  filter:
    LogonProcessName: Advapi
    ComputerName: '%Workstations%'
  condition: selection and not filter
falsepositives:
  - Administrative activity via KVM or ILO board
level: medium
tags:
  - attack.lateral_movement
  - attack.t1078
Rule: Suspicious interactive console logons to servers 2017-03-17 09:44:24 +01:00			`title: Interactive Logon to Server Systems`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: 3ff152b2-1388-4984-9cd9-a323323fdadf`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`status: test`
att&ck tags review: windows/builtin, windows/driver_load, windows/file_event, windows/image_load, windows/other 2020-08-25 01:09:17 +02:00			`description: Detects interactive console logons to Server Systems`
Rule: Suspicious interactive console logons to servers 2017-03-17 09:44:24 +01:00			`author: Florian Roth`
fix: fixed missing date fields in remaining files 2020-01-30 16:07:37 +01:00			`date: 2017/03/17`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`modified: 2021/11/27`
Rule: Suspicious interactive console logons to servers 2017-03-17 09:44:24 +01:00			`logsource:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`product: windows`
			`service: security`
Rule: Suspicious interactive console logons to servers 2017-03-17 09:44:24 +01:00			`detection:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`selection:`
			`EventID:`
			`- 528`
			`- 529`
			`- 4624`
			`- 4625`
			`LogonType: 2`
			`ComputerName:`
			`- '%ServerSystems%'`
			`- '%DomainControllers%'`
			`filter:`
			`LogonProcessName: Advapi`
			`ComputerName: '%Workstations%'`
			`condition: selection and not filter`
Rule: Suspicious interactive console logons to servers 2017-03-17 09:44:24 +01:00			`falsepositives:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- Administrative activity via KVM or ILO board`
Rule: Suspicious interactive console logons to servers 2017-03-17 09:44:24 +01:00			`level: medium`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`tags:`
			`- attack.lateral_movement`
			`- attack.t1078`