Sunturai
Back to results
MediumSigmaHQSwachchhanda Shrawan Poudel (Nextron Systems)

Potentially Suspicious Explicit Credential Local Logon

Detects potentially suspicious explicit credential logon events where the user is trying to logon with explicit credentials (username and password) that are different from the current user context. It might indicate…

Description

Detects potentially suspicious explicit credential logon events where the user is trying to logon with explicit credentials (username and password) that are different from the current user context. It might indicate an attacker attempting to escalate privileges after obtaining credentials for a different user account.

Detection logic

Detection requirements

Platform
Windows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source product
windows
Log source service
security

Known benign triggers

  • Administrative scripts using explicit credentials from non-standard paths
  • RunAs usage from user-installed applications outside Program Files

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice