Admin User Remote Logon

Title: Admin User Remote Logon
Status: test
Description:Detect remote login by Administrator user (depending on internal pattern).
References:
  -https://car.mitre.org/wiki/CAR-2016-04-005
Author: juju4
Date: 2017-10-29
modified:2022-10-09
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.lateral-movement'
• -'attack.initial-access'
• -'attack.stealth'
• -'attack.t1078.001'
• -'attack.t1078.002'
• -'attack.t1078.003'
• -'car.2016-04-005'

Logsource:

• product: windows
• service: security
• definition: Requirements: Identifiable administrators usernames (pattern or special unique character. ex: "Admin-*"), internal policy mandating use only as secondary account

Detection:
  selection:
    EventID: '4624'
    LogonType: '10'
    AuthenticationPackageName: 'Negotiate'
    TargetUserName|startswith: 'Admin'
  condition:selection
Falsepositives:
  -Legitimate administrative activity.
Level: low