Interactive Logon to Server Systems

title: Interactive Logon to Server Systems
id: 3ff152b2-1388-4984-9cd9-a323323fdadf
status: test
description: Detects interactive console logons to Server Systems
references:
    - Internal Research
author: Florian Roth (Nextron Systems)
date: 2017-03-17
modified: 2023-12-15
tags:
    - attack.lateral-movement
    - attack.initial-access
    - attack.persistence
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1078
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID:
            - 528
            - 529
            - 4624
            - 4625
        LogonType: 2
        ComputerName|expand:
            - '%ServerSystems%'
            - '%DomainControllers%'
    filter_main_advapi:
        LogonProcessName: 'Advapi'
        ComputerName|expand: '%Workstations%'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Administrative activity via KVM or ILO board
level: medium