Interactive Logon to Server Systems
This rule detects interactive console logons (LogonType 2) to server systems and domain controllers. It specifically looks for successful (EventID 528, 4624) and failed (EventID 529, 4625) interactive logon attempts. The rule filters out events where the logon process name is 'Advapi' and the computer is a workstation, aiming to reduce false positives from legitimate workstation activities.
Sigma
