RottenPotato Like Attack Pattern

Title: RottenPotato Like Attack Pattern
Status: test
Description:Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like
References:
  -https://twitter.com/SBousseaden/status/1195284233729777665
Author: @SBousseaden, Florian Roth
Date: 2019-11-15
modified:2022-12-22
Tags:

• -'attack.collection'
• -'attack.privilege-escalation'
• -'attack.credential-access'
• -'attack.t1557.001'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID: '4624'
    LogonType: '3'
    TargetUserName: 'ANONYMOUS LOGON'
    WorkstationName: '-'
    IpAddress:
      -'127.0.0.1'
      -'::1'

  condition:selection
Falsepositives:
  -Unknown
Level: high