Outgoing Logon with New Credentials
This rule detects successful logon events (EventID 4624) where the LogonType is 9, which signifies a new credentials logon. This logon type is typically associated with the 'RunAs' command or similar functionality, where a user explicitly provides alternate credentials to execute a program or access a resource. Adversaries may use this technique to execute code with different user privileges or to move laterally within an environment using stolen or compromised credentials.
Sigma
