RottenPotato-like Attack Pattern Detection

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•33

This rule detects logon events (EventID 4624) with LogonType 3 (network logon) where the TargetUserName is 'ANONYMOUS LOGON' and the WorkstationName is '-' (indicating a local system or unknown workstation). Additionally, the source IP address must be a loopback address ('127.0.0.1' or '::1'). This specific combination of characteristics is indicative of a RottenPotato-like attack pattern, which exploits local NTLM relay vulnerabilities to escalate privileges.