Query: detect Detects potentially suspicious explicit credential logon events where the user is trying to logon with explicit credenti in logs
Matching passage: Sigma rule: Detects potentially suspicious explicit credential logon events where the user is trying to logon with explicit credenti. Logsource: windows / security. Rule: title: Potentially Suspicious Explicit Credential Local Logon id: e3c6d245-7b8f-4e2a-c17f-a9d0e5b38f62 status: experimental description: 'Detects potentially suspicious explicit credential logon events where the user is trying to logon with explicit credentials (username and password) that are different from the current user context. It might indicate an attacker attempting to escalate privileges after obtaining credentials for a different user account. ' references: - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648 - https://github.com/MSNightmare/LegacyHive author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-23 tags: - attack.privilege-escalation - attack.stealth - attack.t1134 - attack.t1134.003 logsource: product: windows service: security detection: selection_eid: EventID: 4648 selection_localhost: - TargetServerName: localhost - TargetInfo: localhost - IpAddress: - 127.0.0.1 - ::1 filter_main_computer_accounts: SubjectUserName|endswith: $ filter_main_system_processes: ProcessName|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_main_program_files: ProcessName|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_main_same_user: SubjectUserName|fieldref: TargetUserName condition: all of selection_* and not 1 of filter_main_* falsepositives: - RunAs usage from user-installed applications outside Program Files - Administrative scripts using explicit credentials from non-standard paths level: medium regression_tests_path: regression_data/rules/windows/builtin/security/win_security_explicit_credential_local_logon/info.yml
Near-miss passage: Sigma rule: Attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.. Logsource: windows / ps_classic_provider_start. Rule: title: Tamper Windows Defender - PSClassic id: ec19ebab-72dc-40e1-9728-4c0b805d722c related: - id: 14c71865-6cd3-44ae-adaa-1db923fae5f2 type: similar status: test description: Attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-06-07 modified: 2024-01-02 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: ps_classic_provider_start detection: selection_set_mppreference: Data|contains: Set-MpPreference selection_options_bool_allow: Data|contains: - -dbaf $true - -dbaf 1 - -dbm $true - -dbm 1 - -dips $true - -dips 1 - -DisableArchiveScanning $true - -DisableArchiveScanning 1 - -DisableBehaviorMonitoring $true - -DisableBehaviorMonitoring 1 - -DisableBlockAtFirstSeen $true - -DisableBlockAtFirstSeen 1 - -DisableCatchupFullScan $true - -DisableCatchupFullScan 1 - -DisableCatchupQuickScan $true - -DisableCatchupQuickScan 1 - -DisableIntrusionPreventionSystem $true - -DisableIntrusionPreventionSystem 1 - -DisableIOAVProtection $true - -DisableIOAVProtection 1 - -DisableRealtimeMonitoring $true - -DisableRealtimeMonitoring 1 - -DisableRemovableDriveScanning $true - -DisableRemovableDriveScanning 1 - -DisableScanningMappedNetworkDrivesForFullScan $true - -DisableScanningMappedNetworkDrivesForFullScan 1 - -DisableScanningNetworkFiles $true - -DisableScanningNetworkFiles 1 - -DisableScriptScanning $true - -DisableScriptScanning 1 - -MAPSReporting $false - -MAPSReporting 0 - -drdsc $true - -drdsc 1 - -drtm $true - -drtm 1 - -dscrptsc $true - -dscrptsc 1 - -dsmndf $true - -dsmndf 1 - -dsnf $true - -dsnf 1 - -dss $true - -dss 1 selection_options_actions_func: Data|contains: - HighThreatDefaultAction Allow - htdefac Allow - LowThreatDefaultAction Allow - ltdefac Allow - ModerateThreatDefaultAction Allow - mtdefac Allow - SevereThreatDefaultAction Allow - stdefac Allow condition: selection_set_mppreference and 1 of selection_options_* falsepositives: - Legitimate PowerShell scripts that disable Windows Defender for troubleshooting purposes. Must be investigated. level: high