Admin User Remote Logon (0f63e1ef-1eb9-4226-9d54-8927ca08520a)

Detect remote login by Administrator user (depending on internal pattern).

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Admin User Remote Logon (0f63e1ef-1eb9-4226-9d54-8927ca08520a)	Sigma-Rules	Domain Accounts - T1078.002 (c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f)	Attack Pattern	1
Admin User Remote Logon (0f63e1ef-1eb9-4226-9d54-8927ca08520a)	Sigma-Rules	Local Accounts - T1078.003 (fdc47f44-dd32-4b99-af5f-209f556f63c2)	Attack Pattern	1
Admin User Remote Logon (0f63e1ef-1eb9-4226-9d54-8927ca08520a)	Sigma-Rules	Default Accounts - T1078.001 (6151cbea-819b-455a-9fa6-99a1cc58797d)	Attack Pattern	1
Domain Accounts - T1078.002 (c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f)	Attack Pattern	Valid Accounts - T1078 (b17a1a56-e99c-403c-8948-561df0cffe81)	Attack Pattern	2
Local Accounts - T1078.003 (fdc47f44-dd32-4b99-af5f-209f556f63c2)	Attack Pattern	Valid Accounts - T1078 (b17a1a56-e99c-403c-8948-561df0cffe81)	Attack Pattern	2
Valid Accounts - T1078 (b17a1a56-e99c-403c-8948-561df0cffe81)	Attack Pattern	Default Accounts - T1078.001 (6151cbea-819b-455a-9fa6-99a1cc58797d)	Attack Pattern	2