Query: Sigma rule for Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to loca
Matching passage: Sigma rule: Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to loca. Logsource: windows / security. Rule: title: Potential Privilege Escalation via Local Kerberos Relay over LDAP id: 749c9f5e-b353-4b90-a9c1-05243357ca4b status: test description: 'Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges. ' references: - https://twitter.com/sbousseaden/status/1518976397364056071?s=12&t=qKO5eKHvWhAP19a50FTZ7g - https://github.com/elastic/detection-rules/blob/5fe7833312031a4787e07893e27e4ea7a7665745/rules/_deprecated/privilege_escalation_krbrelayup_suspicious_logon.toml#L38 author: Elastic, @SBousseaden date: 2022-04-27 modified: 2024-08-13 tags: - attack.privilege-escalation - attack.credential-access - attack.t1548 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 3 AuthenticationPackageName: Kerberos IpAddress: 127.0.0.1 TargetUserSid|startswith: S-1-5-21- TargetUserSid|endswith: '-500' filter_main_ip_null: IpPort: '0' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects system restore registry modification via command line, which can be used by adversaries to disable system restor. Logsource: windows / process_creation. Rule: title: System Restore Registry Modification via CommandLine id: 7c06ab9b-b1d2-4ba9-b06e-09491ded20d9 related: - id: 5de03871-5d46-4539-a82d-3aa992a69a83 type: similar status: experimental description: 'Detects system restore registry modification via command line, which can be used by adversaries to disable system restore on the computer. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-9---disable-system-restore-through-registry author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-03-11 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \reg.exe - OriginalFileName: - powershell.exe - pwsh.dll - reg.exe selection_cli_action: CommandLine|contains: - ' add ' - Set-ItemProperty - New-ItemProperty selection_cli_reg_root: CommandLine|contains: - \SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore selection_cli_reg_key: CommandLine|contains: - DisableConfig - DisableSR condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification/info.yml simulation: - type: atomic-red-team name: Disable System Restore Through Registry technique: T1490 atomic_guid: 66e647d1-8741-4e43-b7c1-334760c2047f