Outgoing Logon with New Credentials

Title: Outgoing Logon with New Credentials
Status: test
Description:Detects logon events that specify new credentials
References:
  -https://go.recordedfuture.com/hubfs/reports/mtp-2021-0914.pdf
Author: Max Altgelt (Nextron Systems)
Date: 2022-04-06
modified:None
Tags:

• -'attack.lateral-movement'
• -'attack.t1550'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID: '4624'
    LogonType: '9'
  condition:selection
Falsepositives:
  -Legitimate remote administration activity
Level: low