mdecrevoisier high experimental sigma

Anonymous access performed to multiple targets

Detects scenarios where an attacker would attempt to enumerate hosts and collect relevant information using anonymous access. Vulnerability scanners, enumeration software or tool like CrackMapexec may generate such behavior.

View Source

Detection Logic

{
  "selection": {
    "EventID": 4624,
    "TargetUserSid": "S-1-5-7",
    "LogonType": 3
  },
  "filter": {
    "IpAddress": [
      "%vulnerability_scanners%",
      "127.0.0.1",
      "::1"
    ]
  },
  "condition": "selection and not filter
| count(Computer) by IpAddress > 20",
  "timeframe": "15m"
}

False Positives

⚠ VAS scanners, pentest

Field Validations

Loading…

Comments (0)

Loading comments...