I am referring to https://community.rsa.com/docs/DOC-54594 to work to detect Windows Lateral Movement Detection. There is a rule regarding Correlation Rule: Windows Automated Explicit Logon. It states the threshold count should be greater than 9. Is it compulsory? Doesn't even one automated logon entry raise a concern?

1 Answer 1


I think you are right, you'd want to log some of these all the time. 7045 seems to jump out to me. In comparison, this is the splunk rule:

index=windows   LogName=System  EventCode=7045  NOT 
(Service_Name=tenable_mw_scan)  |   eval
Message=split(Message,".")  |   eval
|   table   _Ome    host    Service_Name,   Service_Type,   Service_Start_Type, 
Service_Account,    Short_Message

reference: https://conf.splunk.com/session/2015/conf2015_MGough_MalwareArchaelogy_SecurityCompliance_FindingAdvnacedAttacksAnd.pdf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.