Event ID 4624: An account was successfully logged on
Written on the machine that was logged on to, every time an account successfully logs on: people, services, computers and scheduled tasks.
- Log
- Security
- Category
- Logon
Why it matters
- The Logon Type field says how: 2 is at the keyboard, 3 is over the network (file shares, many admin tools), 10 is Remote Desktop.
- Network logons (type 3) using NTLM from unusual sources are a common sign of pass-the-hash and lateral movement.
- Machine accounts (ending in $) and service logons are very noisy; filter them before hunting.
What to check
Check Logon Type, Account Name, Source Network Address, Workstation Name, Authentication Package (NTLM or Kerberos) and Elevated Token. Correlate the Logon ID with 4672, 4688 and 4634 to see what the session did.
How to turn it on
Advanced Audit Policy: Logon/Logoff > Audit Logon (Success).
Logon types
| Type | Name | Meaning |
|---|---|---|
| 2 | Interactive | At the keyboard or console. |
| 3 | Network | Over the network: file shares, many admin tools, PsExec, WMI. |
| 4 | Batch | Scheduled tasks. |
| 5 | Service | A service started by the Service Control Manager. |
| 7 | Unlock | Unlocking the workstation. |
| 8 | NetworkCleartext | Network logon with the password sent in cleartext, such as IIS basic authentication. |
| 9 | NewCredentials | runas /netonly: local identity unchanged, other credentials used for network access. |
| 10 | RemoteInteractive | Remote Desktop. |
| 11 | CachedInteractive | Logon with cached domain credentials, without contacting a domain controller. |
| 12 | CachedRemoteInteractive | Remote Desktop using cached credentials. |
| 13 | CachedUnlock | Unlock using cached credentials. |
MITRE ATT&CK
- T1078 Valid Accounts
- T1021.001 Remote Desktop Protocol
- T1550.002 Pass the Hash