Remote Logon by Admin User
This rule detects successful remote logons by users whose usernames start with 'Admin' (e.g., Administrator, Admin-SQL) on Windows systems. It specifically looks for Event ID 4624 (successful logon), Logon Type 10 (RemoteInteractive), and the Negotiate authentication package. The rule aims to identify potential misuse of administrative accounts for remote access, which could indicate privilege escalation, persistence, or lateral movement. Its effectiveness relies on an internal pattern for administrator usernames and a policy mandating that these accounts are only used as secondary accounts.
Sigma
