Privileged User Logon Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•24

Detects logon events (Event ID 4672 and 4964) involving accounts with special privileges or belonging to special groups, such as administrators. The rule filters out the local system account (S-1-5-18) and allows for a configurable filter for valid internal accounts to reduce false positives.