LoFP
/
t1550
t1550
Title
Tags
a user may have multiple sessions open at the same time, such as on a mobile device and a laptop.
t1550
okta
elastic
administrator activity
t1069
t1069.002
t1087
t1087.002
t1550
t1550.002
windows
sigma
assumerole from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.
t1548
t1550
t1550.001
aws
sigma
assumerole may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
t1548
t1550
t1550.001
aws
sigma
automated processes that uses terraform may lead to false positives.
t1078
t1548
t1550
t1550.001
aws
sigma
aws administrators or automated processes might regularly assume roles for legitimate administrative purposes and to perform periodic tasks such as data backups, updates, or deployments.
t1548
t1550
t1556
aws
elastic
based on microsoft documentation, legacy systems or applications will use rc4-hmac as the default encryption for tgt requests. specifically, systems before windows server 2008 and windows vista. newer systems will use aes128 or aes256.
t1550
endpoint
splunk
custom applications may leverage the kerberos protocol. filter as needed.
t1550
endpoint
splunk
developers may leverage third-party applications for legitimate purposes in google workspace such as for administrative tasks.
t1078
t1550
google_workspace
elastic
environments that use ntlmv1
t1550
t1550.002
windows
sigma
getsessiontoken may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. getsessiontoken from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.
t1548
t1550
aws
elastic
getsignintoken events will occur when using aws sso portal to login and will generate false positives if you do not filter for the expected user agent(s), see filter. non-sso configured roles would be abnormal and should be investigated.
t1021
t1021.007
t1550
t1550.001
aws
sigma
go utilities that use staaldraad awesome ntlm library
t1059
t1087
t1114
t1550
t1550.002
windows
sigma
if key credentials are regularly assigned to users, these events will need to be tuned out.
t1222.001
t1550
endpoint
splunk
legacy hosts
t1550
t1550.002
windows
sigma
legitimate remote administration activity
t1550
windows
sigma
legitimate users may encounter access denied errors during permission testing, role transitions, or when service permissions are being reconfigured. access denials may also happen when automated processes are using outdated credentials or when new bedrock features are being explored.
t1078
t1550
aws account
splunk
role chaining can be used as an access control. ensure that this behavior is not part of a legitimate operation before taking action.
t1548
t1550
aws
elastic
runas command-line tool using /netonly parameter
t1550
t1550.002
windows
sigma
saml provider being updated from unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.
t1078
t1548
t1550
t1550.001
aws
sigma
this is very uncommon behavior and should result in minimal false positives, ensure validity of the triggered event and include exceptions where necessary.
t1021
t1550
aws
elastic
this pattern may occur during legitimate device switching or roaming between networks (e.g., corporate to mobile). developers or power users leveraging multiple environments may also trigger this detection if session persistence spans ip ranges. still, this behavior is rare and warrants investigation when rapid ip switching and graph access are involved.
t1078
t1550
azure
elastic
web browsers and third party application might generate similar activity. an initial baseline is required.
t1550
t1550.003
t1558
t1558.003
windows
sigma