Potential Account Takeover via Mixed Logon Types

This detection identifies potential account takeover scenarios by monitoring Windows Security Event Logs for unusual logon patterns. Specifically, it focuses on user accounts that typically log in with a specific logon type (e.g., service accounts using Batch or Network logon) but suddenly exhibit successful logons using a different logon type with significantly lower frequency. This behavior could indicate that an attacker has compromised the account's credentials and is using them from a new context, such as interactive or network logons, which were not previously associated with the account. The rule is designed to detect suspicious activity and alert security teams to potential account compromises, enabling them to investigate and mitigate the threat. It operates by analyzing Windows Security Event ID 4624 logs and uses statistical analysis to identify accounts with mixed logon types and significant discrepancies in logon counts.

Attack Chain

1. Credential Compromise: An attacker gains access to a valid user account's credentials through various means, such as phishing, malware, or brute-force attacks.
2. Initial Access: The attacker uses the compromised credentials to attempt to log in to a system.
3. Successful Authentication (Unusual Logon Type): The attacker successfully authenticates using a logon type that is atypical for the compromised account (e.g., interactive logon for a service account). This generates Windows Security Event ID 4624.
4. Lateral Movement: After gaining initial access, the attacker may attempt to move laterally to other systems within the network using the compromised credentials.
5. Privilege Escalation: The attacker may attempt to escalate their privileges on the compromised system or other systems they can access.
6. Data Exfiltration/Malicious Activity: The attacker uses the compromised account to access sensitive data or perform malicious activities.
7. Persistence: The attacker may attempt to establish persistence mechanisms to maintain access to the compromised system or network.

Impact

A successful account takeover can lead to significant damage, including unauthorized access to sensitive data, financial loss, reputational damage, and disruption of business operations. Depending on the privileges associated with the compromised account, attackers could potentially escalate their privileges, move laterally within the network, and gain access to critical systems and data. The impact can range from minor data breaches to complete system compromise and significant financial losses. Targeted sectors could include any organization that relies on Windows-based systems and uses service accounts or other accounts with specific logon type profiles.

Recommendation

• Deploy the Sigma rule "Potential Account Takeover - Mixed Logon Types" to your SIEM and tune the thresholds (e.g., max_logon, min_logon) to match your environment's baseline and reduce false positives.
• Investigate any alerts generated by the Sigma rule by correlating with other alerts for the same user, such as logons from new source IPs or password changes.
• Review which logon types appear in the winlog.logon.type field in your security logs to understand the different logon types observed in your environment.
• Implement multi-factor authentication (MFA) for all user accounts, including service accounts, to mitigate the risk of credential compromise.
• Monitor Windows Security Event Logs (specifically Event ID 4624) for unusual logon activity, focusing on accounts with mixed logon types.
• Establish a baseline of expected logon types for different user accounts and services within your environment to identify deviations more effectively.