Remote interactive NTLM logon or explicit-credential remote access

Siemphony@siemphonylowT1021unverified

AN0750 names "logon via RDP or WMI" and gives two Security event IDs for it, so this rule has an arm for each. The first matches a successful remote interactive logon (4624, LogonType 10 — the RDP session) whose logon process is NtLmSsp: inside a domain that means the client connected by IP address or from a host that could not obtain a ticket, which is the shape of an adversary reusing valid credentials. The second matches 4648, a logon with explicitly supplied credentials, narrowed to the source-side binaries that drive remote services — the RDP client, WMI, WinRM and PowerShell remoting — which is the WMI half of the analytic and the part of "Remote Services" that is not RDP. Three caveats. LogonType 10 is RDP alone, so the first arm is really T1021.001 evidence appearing under the parent. The NtLmSsp test has not been checked against a real corpus of NLA sessions: with Network Level Authentication the credential is validated first as a network logon and the session record is brokered through CredSSP/Negotiate, so the NTLM evidence may sit on the preceding LogonType 3 event rather than on the type 10 one, and this arm would then see only the legacy half of the population. Kerberos-backed RDP with the same stolen credentials is invisible either way. The post-access half of the analytic — uncommon command execution or onward connections inside a correlation window — is a sequence Sigma cannot express, so only the logon precursor is authored here. 4624 and 4648 both come from the Logon/Logoff audit category, on in a default domain-member configuration, but confirm success auditing is enabled before reading a quiet result as an absence of activity. EventID and LogonType are written unquoted so they render as numeric comparisons, which is correct for Sentinel's SecurityEvent table; an ECS/Elastic pipeline indexes winlog.event_data.LogonType as a keyword string, so that rendering needs the values quoted by hand before it will match anything. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0269, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

SecurityEvent| where ((EventID == 4624 and LogonType == 10 and LogonProcessName =~ "NtLmSsp") or (EventID == 4648 and (ProcessName endswith "\\mstsc.exe" or ProcessName endswith "\\wmic.exe" or ProcessName endswith "\\winrs.exe" or ProcessName endswith "\\powershell.exe" or ProcessName endswith "\\pwsh.exe" or ProcessName endswith "\\psexec.exe" or ProcessName endswith "\\psexec64.exe")))

Splunk · SPL

Run this as a search.

index=* ((EventID="4624" AND LogonType="10" AND LogonProcessName="NtLmSsp") OR (EventID="4648" AND (ProcessName="*\\mstsc.exe" OR ProcessName="*\\wmic.exe" OR ProcessName="*\\winrs.exe" OR ProcessName="*\\powershell.exe" OR ProcessName="*\\pwsh.exe" OR ProcessName="*\\psexec.exe" OR ProcessName="*\\psexec64.exe")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((event.code == 4624 AND LogonType == 10 AND TO_LOWER(LogonProcessName) == "ntlmssp") OR (event.code == 4648 AND (TO_LOWER(ProcessName) LIKE "*\\\\mstsc.exe" OR TO_LOWER(ProcessName) LIKE "*\\\\wmic.exe" OR TO_LOWER(ProcessName) LIKE "*\\\\winrs.exe" OR TO_LOWER(ProcessName) LIKE "*\\\\powershell.exe" OR TO_LOWER(ProcessName) LIKE "*\\\\pwsh.exe" OR TO_LOWER(ProcessName) LIKE "*\\\\psexec.exe" OR TO_LOWER(ProcessName) LIKE "*\\\\psexec64.exe")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4624$</field>    <field name="LogonType" type="pcre2">(?i)^10$</field>    <field name="LogonProcessName" type="pcre2">(?i)^NtLmSsp$</field>    <description>Remote interactive NTLM logon or explicit-credential remote access (1/2)</description>    <mitre>      <id>T1021</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4648$</field>    <field name="ProcessName" type="pcre2">(?i)(\\mstsc\.exe$|\\wmic\.exe$|\\winrs\.exe$|\\powershell\.exe$|\\pwsh\.exe$|\\psexec\.exe$|\\psexec64\.exe$)</field>    <description>Remote interactive NTLM logon or explicit-credential remote access (2/2)</description>    <mitre>      <id>T1021</id>    </mitre>  </rule></group>

At a glance

Logsource: security / windows
Level: low
Category: lateral_movement_remote_exec
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: d5a88589-6665-4ba6-acbd-ddcf87560375

ATT&CKT1021

T1021Remote Services

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonlateral movement remote exec

lateral movement remote exec

01 · What this rule detects

Code executed on a remote host from another host inside the network — the step where an attacker moves from their initial foothold to a system that matters.

02 · Telemetry you need

Process creation with parent process on the destination host
Logon events with logon type, to distinguish network from interactive
Service creation events on the destination
Named pipe and SMB activity where available

03 · How the logic works

Remote execution shows up on the destination as a process whose parent is a service host, WMI provider, or the service control manager, combined with a network logon shortly before. Match the parent-child relationships that remote execution produces rather than the tool names — the parentage is a property of how Windows executes remote code and is much harder to avoid than a binary name. Correlating with the preceding logon gives you the source host and account, which is what an analyst needs first.

04 · Common false positives

Remote administration and patch management performing exactly this pattern by design
Monitoring agents that execute remote queries
Clustering and failover software coordinating across nodes
Vulnerability scanners with credentialed scanning enabled

05 · Detection maturity

Tier 1 — starting point: Matches known remote execution tool names.
Tier 2 — tuned: Matches the parent-child patterns remote execution produces, excluding management servers by source.
Tier 3 — correlated: Correlates with the preceding network logon and scores on whether that source-account-destination triple is normal.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude by source host rather than by tool — your management servers are a short, stable list
Direction matters: workstation to server is routine, server to workstation rarely is
Enrich with whether the source account normally authenticates to that destination
Administrative tooling used from an unusual source is the case worth alerting on

Declared by the author

RDP with a local, non-domain account on a domain-joined server — break-glass, vendor and MSP accounts, or a service owner's local account. These can never obtain a Kerberos ticket, so they are NTLM at LogonType 10 every single time, and this is the largest benign generator of the first arm. TargetDomainName equal to the target's own computer name is the field-level discriminator.
Administrators connecting to servers by IP address or by an alias that has no matching SPN. Kerberos cannot be used, so an entirely routine jumpbox session looks identical. MITRE's RemoteHostList knob exists for this — allowlist the IpAddress values of sanctioned jumpboxes and deployment hosts before this rule is usable.
Estates with non-domain-joined or workgroup servers, DMZ hosts and appliances, where NTLM is the only option and every legitimate RDP session matches. Scope the rule to domain members, or apply MITRE's LogonUser knob to keep only service and privileged accounts.
Routine explicit-credential admin work on the second arm: mstsc.exe with saved or typed credentials, wmic and Invoke-Command run with -Credential from an admin workstation, and scheduled inventory or backup jobs that authenticate as a separate account. On a jumpbox this arm is close to continuous.
Remote-support and screen-sharing products that establish a LogonType 10 session with locally stored credentials during a helpdesk call.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1021, evaluated against their — events.

Share this rule

/u/siemphony/d5a88589-6665-4ba6-acbd-ddcf87560375

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Remote interactive NTLM logon or explicit-credential remote access

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it