Situational AwarenessCAR-2013-10-001

User Login Activity Monitoring

Hypothesis and description

Monitoring logon and logoff events for hosts on the network is very important for situational awareness. This information can be used as an indicator of unusual activity as well as to corroborate activity seen elsewhere.

Could be applied to a number of different types of monitoring depending on what information is desired. Some use cases include monitoring for all remote connections and building login timelines for users.

Logon events are Windows Event Code 4624 for Windows Vista and above, 518 for pre-Vista. Logoff events are 4634 for Windows Vista and above, 538 for pre-Vista.

### Output Description

The time of login events for distinct users on individual systems

Platforms: Windows, Linux, macOS
Domain: Host, Network
Subtypes: Login, Netflow
Submitted: 2013-10-03
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1021 Remote ServicesT1021.001	Lateral Movement	Moderate
T1078 Valid AccountsT1078.002, T1078.003	Stealth (formerly Defense Evasion)	Moderate

2 techniques, 5 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

D3FEND techniques MITRE maps to this analytic

D3-ANET Authentication Event Thresholding

Pseudocode and implementations

PseudocodeAccount Logon with Filtering

This base pseudocode looks for user logon events and filters out the top 30 account names to reduce the occurrence of noisy service accounts and the like. It is meant as a starting point for situational awareness around such events.

logon_events = search User_Session:Login
filtered_logons = filter logon_events where (
  user NOT IN TOP30(user))
output filtered_logons

SplunkAccount Logon with Filtering

Splunk version of the above pseudocode. NOTE - this is liable to be quite noisy and will need tweaking, especially in terms of the number of top users filtered out.

index=__your_win_event_log_index__ EventCode=4624|search NOT [search index=__your_win_event_log_index__ EventCode=4624|top 30 Account_Name|table Account_Name]

DNIFAccount Logon with FilteringData model: Sysmon native

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-NXLOG-AUDIT AND $SubSystem=AUTHENTICATION AND $Action=LOGIN group count_unique $ScopeID, $User limit 30
>>_store in_disk david_test win_top_30 stack_replace
>>_fetch * from event where $LogName=WINDOWS-NXLOG-AUDIT AND $SubSystem=AUTHENTICATION AND $Action=LOGIN limit 10000
>>_checkif lookup david_test win_top_30 join $ScopeID = $ScopeID str_compare $User eq $User exclude

Across MITRE's defensive frameworks

Linked through the 2 ATT&CK techniques above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

8 more in the full list

View CAR-2013-10-001 on car.mitre.org