Rule: Suspicious interactive console logons to servers

2017-03-17 09:44:24 +01:00
parent bcc250e1c7
commit dd81b18d6e
1 changed files with 26 additions and 0 deletions
@@ -0,0 +1,26 @@
+title: Interactive Logon to Server Systems
+description: Detects interactive console logons to 
+author: Florian Roth
+logsource:
+    product: windows
+    service: security
+detection:
+    selection:
+        EventID:
+            - 528
+            - 529
+            - 4624
+            - 4625
+        LogonType: 2
+        ComputerName:
+            - '%ServerSystems%'
+            - '%DomainControllers%'
+    filter:
+        LogonProcessName: Advapi
+        ComputerName: '%Workstations%'
+    condition: selection and not filter
+falsepositives:
+    - Administrative activity via KVM or ILO board
+level: medium
+
+