New-credentials logon created by the secondary logon service

1title: New-credentials logon created by the secondary logon service2id: 222885e5-e4e2-4365-a242-183cbb040ff53status: experimental4description: |5  Matches Security 4624 logon sessions of type 9 (NewCredentials) created by the6  Secondary Logon service, which is the record Windows writes when a process is7  started under an alternate account for network use only — the local artefact of8  authenticating as another user without ever holding their cleartext password,9  and the event a hash-injection tool produces on the host it is run from. This10  is MITRE's LogonTypeFilter knob set here to type 9, rather than to the type 311  and type 10 that the knob's own examples name: type 3 NTLM is the target-side12  view, it is far noisier, and it is already the shape of the T1021 rule in this13  corpus, whereas type 9 fires once, on the operator's own machine, at the moment14  the credential is injected. The rule sees that injection and not its use — the15  onward SMB, WMI or service creation performed under the new session is a16  separate event and Sigma cannot join them — and it cannot compare the17  requesting account against the supplied account, which is the field pair that18  would actually separate an operator from an adversary. Unlike much of this19  corpus the rule needs no audit-policy change, since 4624 is collected by20  default under Logon/Logoff success, but the record exists only on the source21  host and never reaches a domain controller, so a fleet-wide endpoint feed is22  the prerequisite instead.23  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0409, not hand-written and not tested by its author. Any lab result is on this rule's own page.24references:25  - https://attack.mitre.org/techniques/T1550/00226  - https://attack.mitre.org/detectionstrategies/DET040927author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)28date: 2026-08-1629tags:30  - attack.lateral-movement31  - attack.t1550.00232logsource:33  product: windows34  service: security35detection:36  selection:37    EventID: 462438    LogonType: 939    LogonProcessName: 'seclogo'40    AuthenticationPackageName: 'Negotiate'41  condition: selection42falsepositives:43  - "Administrators using runas /netonly to open a management console, an RSAT snap-in or a database client under a privileged account from an unprivileged desktop. This is the intended use of the mechanism, it is the dominant source of matches by a wide margin, and at the event level it is indistinguishable from an injected hash — which is why this rule is not rated higher."44  - "Management tooling that offers a connect-as-a-different-user option, such as SQL client tools, remote administration consoles and deployment utilities, which request a new-credentials session on the user's behalf without anyone typing runas."45  - "Cross-forest, workgroup and DMZ administration, where supplying credentials for network use only is the only way to reach the resource, so every routine session from an operator's workstation matches."46  - "Build agents and developer tooling that authenticate to an internal artifact, source or package server by launching a child process under a stored service account."47level: medium