Logon by the built-in Administrator or Guest account

1title: Logon by the built-in Administrator or Guest account2id: 24807dd6-6b60-43dd-90c1-67b7b4199c243status: experimental4description: |5  AN1283 asks for the built-in default accounts — the technique's own text6  names Administrator and Guest specifically — performing "interactive or7  remote logons." This rule matches EventID 4624 (a completed logon),8  restricted to LogonType 2 (interactive), 3 (network — the ADMIN$/C$ and9  named-pipe path most PsExec-style tooling and remote admin actually takes)10  or 10 (RemoteInteractive, RDP), or EventID 4648 (a logon attempted with11  explicitly supplied credentials, the shape a runas, a mapped drive or a12  scheduled task under an alternate account takes), in both cases where13  TargetUserName is one of those two names. The LogonType filter applies only14  to the 4624 branch: 4648 has no LogonType field on the raw event at all —15  it records that alternate credentials were supplied, not what kind of16  session they were then used to open — so an earlier draft of this rule17  ANDed LogonType across both event IDs and silently killed the entire 464818  branch, the same trap this corpus's T1021 rule sidesteps by filtering 464819  on ProcessName instead. Batch and service logons (4, 5) are excluded from20  the 4624 branch on purpose: a scheduled task or a Windows service21  legitimately running as a local account is a configuration choice, not the22  "someone logged into this box as Guest" behaviour the analytic describes.23  MITRE's own knob concedes the largest hole in this rule before it is even24  deployed: "Default usernames like 'Administrator' or 'Guest' may be renamed25  or disabled by the organization. Detection logic should account for name26  changes" — a literal TargetUserName match cannot account for a rename,27  because at that point the account's SID is the only thing still tying it to28  its default-account identity, and 4624/4648 do not carry the well-known SID29  suffix (-500 for the built-in Administrator, -501 for Guest) in a field30  this pipeline can bind to; TargetSid is present on the raw event but is31  rendered as a full SID string with the RID at the end, which needs an32  endswith rather than an equality match and is not attempted here since no33  rule in this corpus has established that field. An estate that renames its34  defaults per Microsoft's own guidance is therefore invisible to this rule35  entirely, and a quiet result there means the mitigation worked, not that36  the technique failed to fire. The TimeWindow knob — restricting matches to37  outside installation or maintenance windows — needs a schedule baseline38  lib/sigma has no construct for, so every match here carries equal weight39  regardless of when it happened.40  The Linux leg, AN1284, is not attempted in this file: lib/sigma renders one41  logsource per rule, and 4624/4648 is the better-established of the two42  vocabularies in this corpus. For the record, AN1284's {product: linux,43  service: auditd} USER_LOGIN source is real but its SSHMethod knob —44  password versus key-based authentication — is not a field raw auditd's45  USER_LOGIN record carries; that distinction lives in a separate USER_AUTH46  record keyed to the PAM module that ran, which this pipeline has not47  established a vocabulary for.48  Prerequisite: 4624 and 4648 are both written by the Logon/Logoff audit49  category, on by default and in both the Microsoft and CIS baselines, but a50  host whose audit policy was rewritten can still be blind — confirm with51  auditpol rather than assuming.52  UNVERIFIED — derived from MITRE ATT&CK DET0465 and never executed against logs.53references:54  - https://attack.mitre.org/techniques/T1078/00155  - https://attack.mitre.org/detectionstrategies/DET046556author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)57date: 2026-08-1858tags:59  - attack.defense-evasion60  - attack.persistence61  - attack.privilege-escalation62  - attack.initial-access63  - attack.t1078.00164logsource:65  product: windows66  service: security67detection:68  selection_4624_typed:69    EventID: 462470    LogonType:71      - 272      - 373      - 1074  selection_4648_explicit:75    EventID: 464876  selection_default_account:77    TargetUserName:78      - 'Administrator'79      - 'Guest'80  condition: (selection_4624_typed or selection_4648_explicit) and selection_default_account81falsepositives:82  - "Legacy or third-party remote-administration tooling that authenticates as the built-in local Administrator over LogonType 3 to reach ADMIN$ or C$ — older PsExec-style deployment tools, some vulnerability scanners, and backup or imaging agents that were never migrated to a dedicated service account. On an estate still running any of these this is the loudest source here, which is why the level is medium rather than high."83  - "Break-glass use of the built-in local Administrator account during a domain-controller or authentication outage, when it is the only account guaranteed to still work — a rare but entirely legitimate and expected trigger of this rule."84  - "Freshly imaged or newly provisioned, not-yet-domain-joined servers where the local Administrator account is the only one that exists until provisioning finishes and named admin accounts are granted access — MITRE's own TimeWindow knob is aimed at exactly this window."85  - "Kiosk, lab or legacy line-of-business systems where the Guest account has been deliberately left enabled for compatibility, producing routine interactive or network logons that are sanctioned rather than adversarial."86level: medium