kqlElastic-2.0from elastic/detection-rules

First Time Seen NewCredentials Logon Process

Quality

FP risk

—

Forks

Views

ATT&CK techniques

T1134 T1134.001

Rule sourcerules/windows/privilege_escalation_newcreds_logon_rare_process.toml

event.category:"authentication" and host.os.type:"windows" and winlog.logon.type:"NewCredentials" and
    winlog.event_data.LogonProcessName:Advapi* and
    not winlog.event_data.SubjectUserName:*$ and
    not process.executable: (C\:\\Program*Files*\(x86\)\\*.exe or C\:\\Program*Files\\*.exe)