Query: alert when This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that
Matching passage: Sigma rule: This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that. Logsource: windows / security. Rule: title: Account Tampering - Suspicious Failed Logon Reasons id: 9eb99343-d336-4020-a3cd-67f3819e68ee status: test description: This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625 - https://twitter.com/SBousseaden/status/1101431884540710913 author: Florian Roth (Nextron Systems) date: 2017-02-19 modified: 2025-10-17 tags: - attack.persistence - attack.privilege-escalation - attack.initial-access - attack.stealth - attack.t1078 logsource: product: windows service: security detection: selection_eid: EventID: - 4625 - 4776 selection_status: - Status: - '0xC0000072' - '0xC000006F' - '0xC0000070' - '0xC0000413' - '0xC000018C' - '0xC000015B' - SubStatus: - '0xC0000072' - '0xC000006F' - '0xC0000070' - '0xC0000413' - '0xC000018C' - '0xC000015B' filter: SubjectUserSid: S-1-0-0 condition: all of selection_* and not filter falsepositives: - User using a disabled account level: medium
Near-miss passage: Sigma rule: Detects suspicious child processes of electron apps (teams, discord, slack, etc.). This could be a potential sign of ".a. Logsource: windows / process_creation. Rule: title: Suspicious Electron Application Child Processes id: f26eb764-fd89-464b-85e2-dc4a8e6e77b8 related: - id: 378a05d8-963c-46c9-bcce-13c7657eac99 type: similar status: test description: 'Detects suspicious child processes of electron apps (teams, discord, slack, etc.). This could be a potential sign of ".asar" file tampering (See reference section for more information) or binary execution proxy through specific CLI arguments (see related rule) ' references: - https://taggart-tech.com/quasar-electron/ - https://github.com/mttaggart/quasar - https://positive.security/blog/ms-officecmd-rce - https://lolbas-project.github.io/lolbas/Binaries/Msedge/ - https://lolbas-project.github.io/lolbas/Binaries/Teams/ - https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/ - https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-21 modified: 2024-07-12 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \chrome.exe - \discord.exe - \GitHubDesktop.exe - \keybase.exe - \msedge.exe - \msedgewebview2.exe - \msteams.exe - \slack.exe - \teams.exe selection_child_image: Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \whoami.exe - \wscript.exe selection_child_paths: Image|contains: - :\ProgramData\ - :\Temp\ - \AppData\Local\Temp\ - \Users\Public\ - \Windows\Temp\ filter_optional_discord: ParentImage|endswith: \Discord.exe Image|endswith: \cmd.exe CommandLine|contains: \NVSMI\nvidia-smi.exe condition: selection_parent and 1 of selection_child_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium