UnknownMicrosoft Sentinel analytics
Anomalous Resource Access
The adversary may be trying to move through the environment. APT29 and APT32, for example, have used PtH and PtT techniques to lateral move around the network. The query below generates an output of all users…
Description
The adversary may be trying to move through the environment. APT29 and APT32, for example, have used PtH and PtT techniques to lateral move around the network. The query below generates an output of all users performing resource access (4624:3) to devices for the first time.
Detection logic
Detection requirements
- Platform
- ContainersIaaSIdentity ProviderLinuxOffice SuiteSaaSWindows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
- Log source product
- behavioranalytics
- Log source service
- behavioranalytics
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
No references are available for this detection.
From the source
- At source
- Open at source
- Upstream identifier
- 782f3bad-31f7-468f-8f58-3b74fc931914
- Tagged by the source as
- LateralMovement
Licence
- Published under
- MIT LicenseRead the licence
- Attribution
- Required
- Obtained under
- MITRead the origin licence
Authorship
- Published
- Sep 1, 2026
- Version
- 1