Remote interactive NTLM logon or explicit-credential remote access

1title: Remote interactive NTLM logon or explicit-credential remote access2id: d5a88589-6665-4ba6-acbd-ddcf875603753status: experimental4description: |5  AN0750 names "logon via RDP or WMI" and gives two Security event IDs for it,6  so this rule has an arm for each. The first matches a successful remote7  interactive logon (4624, LogonType 10 — the RDP session) whose logon process8  is NtLmSsp: inside a domain that means the client connected by IP address or9  from a host that could not obtain a ticket, which is the shape of an adversary10  reusing valid credentials. The second matches 4648, a logon with explicitly11  supplied credentials, narrowed to the source-side binaries that drive remote12  services — the RDP client, WMI, WinRM and PowerShell remoting — which is the13  WMI half of the analytic and the part of "Remote Services" that is not RDP.14  Three caveats. LogonType 10 is RDP alone, so the first arm is really15  T1021.001 evidence appearing under the parent. The NtLmSsp test has not been16  checked against a real corpus of NLA sessions: with Network Level17  Authentication the credential is validated first as a network logon and the18  session record is brokered through CredSSP/Negotiate, so the NTLM evidence may19  sit on the preceding LogonType 3 event rather than on the type 10 one, and20  this arm would then see only the legacy half of the population. Kerberos-backed21  RDP with the same stolen credentials is invisible either way. The post-access22  half of the analytic — uncommon command execution or onward connections inside23  a correlation window — is a sequence Sigma cannot express, so only the logon24  precursor is authored here.25  4624 and 4648 both come from the Logon/Logoff audit category, on in a default26  domain-member configuration, but confirm success auditing is enabled before27  reading a quiet result as an absence of activity. EventID and LogonType are28  written unquoted so they render as numeric comparisons, which is correct for29  Sentinel's SecurityEvent table; an ECS/Elastic pipeline indexes30  winlog.event_data.LogonType as a keyword string, so that rendering needs the31  values quoted by hand before it will match anything.32  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0269, not hand-written and not tested by its author. Any lab result is on this rule's own page.33references:34  - https://attack.mitre.org/techniques/T102135  - https://attack.mitre.org/detectionstrategies/DET026936author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)37date: 2026-08-1638tags:39  - attack.lateral-movement40  - attack.t102141logsource:42  product: windows43  service: security44detection:45  selection_rdp_ntlm:46    EventID: 462447    LogonType: 1048    LogonProcessName: 'NtLmSsp'49  selection_explicit_credentials:50    EventID: 464851    ProcessName|endswith:52      - '\mstsc.exe'53      - '\wmic.exe'54      - '\winrs.exe'55      - '\powershell.exe'56      - '\pwsh.exe'57      - '\psexec.exe'58      - '\psexec64.exe'59  condition: 1 of selection_*60falsepositives:61  - "RDP with a local, non-domain account on a domain-joined server — break-glass, vendor and MSP accounts, or a service owner's local account. These can never obtain a Kerberos ticket, so they are NTLM at LogonType 10 every single time, and this is the largest benign generator of the first arm. TargetDomainName equal to the target's own computer name is the field-level discriminator."62  - "Administrators connecting to servers by IP address or by an alias that has no matching SPN. Kerberos cannot be used, so an entirely routine jumpbox session looks identical. MITRE's RemoteHostList knob exists for this — allowlist the IpAddress values of sanctioned jumpboxes and deployment hosts before this rule is usable."63  - "Estates with non-domain-joined or workgroup servers, DMZ hosts and appliances, where NTLM is the only option and every legitimate RDP session matches. Scope the rule to domain members, or apply MITRE's LogonUser knob to keep only service and privileged accounts."64  - "Routine explicit-credential admin work on the second arm: mstsc.exe with saved or typed credentials, wmic and Invoke-Command run with -Credential from an admin workstation, and scheduled inventory or backup jobs that authenticate as a separate account. On a jumpbox this arm is close to continuous."65  - "Remote-support and screen-sharing products that establish a LogonType 10 session with locally stored credentials during a helpdesk call."66level: low