4624 Security log · Logon/Logoff medium severity very-high volume

Windows Event ID 4624 — An account was successfully logged on

A logon session was created. LogonType: 2=Interactive, 3=Network, 4=Batch, 5=Service, 7=Unlock, 8=NetworkCleartext, 9=NewCredentials (runas), 10=RemoteInteractive (RDP), 11=CachedInteractive.

Why event 4624 matters

One of the most-searched events. LogonType 3 from admin accounts to non-DC hosts signals lateral movement. LogonType 10 = RDP. Pass-the-Hash (Mimikatz, Impacket) and Pass-the-Ticket (Rubeus) generate logon events. ANONYMOUS LOGON on Type 3 = null session attack.

How to detect it

Filter: LogonType=3 + TargetUserName not ending '$' + IpAddress outside trusted subnets. Alert: ANONYMOUS LOGON on any type. Alert: LogonType=9 from non-admin accounts. Baseline admin logon patterns — off-hours or new source IPs are high signal.

Log source
Security
Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).
Fields to pivot on
TargetUserNameLogonTypeIpAddressWorkstationNameAuthenticationPackageName

MITRE ATT&CK mapping

Tactic Technique
Initial Access Valid Accounts (T1078)
Lateral Movement Pass the Hash (T1550.002)
Lateral Movement Remote Desktop Protocol (T1021.001)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Suspicious Network Logon
status: experimental
description: Network logon (Type 3) from non-machine account — possible lateral movement
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624
        LogonType: 3
    filter_machine:
        TargetUserName|endswith: '$'
    condition: selection and not filter_machine
falsepositives:
    - Legitimate remote administration
level: low
tags:
    - attack.lateral_movement
    - attack.t1550.002
Sentinel / Defender KQL
SecurityEvent
| where EventID == 4624   // An account was successfully logged on
| project TimeGenerated, Computer, TargetUserName, LogonType, IpAddress, WorkstationName, AuthenticationPackageName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4624
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# An account was successfully logged on — add EventData fields: TargetUserName, LogonType, IpAddress, WorkstationName`
Hunt event 4624 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

References

Related Logon/Logoff events

4625 An account failed to log on 4626 User/Device claims information 4627 Group membership information 4634 An account was logged off 4647 User initiated logoff 4648 A logon was attempted using explicit credentials 4649 A replay attack was detected 4672 Special privileges assigned to new logon 4778 A session was reconnected to a Window Station 4779 A session was disconnected from a Window Station 4800 The workstation was locked 4801 The workstation was unlocked

Frequently asked questions

What is Windows Event ID 4624?

An account was successfully logged on. A logon session was created. LogonType: 2=Interactive, 3=Network, 4=Batch, 5=Service, 7=Unlock, 8=NetworkCleartext, 9=NewCredentials (runas), 10=RemoteInteractive (RDP), 11=CachedInteractive.

Which log records event 4624?

Event 4624 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4624?

Event 4624 is associated with: Valid Accounts (T1078), Pass the Hash (T1550.002), Remote Desktop Protocol (T1021.001).

How do you detect activity around event 4624?

Filter: LogonType=3 + TargetUserName not ending '$' + IpAddress outside trusted subnets. Alert: ANONYMOUS LOGON on any type. Alert: LogonType=9 from non-admin accounts. Baseline admin logon patterns — off-hours or new source IPs are high signal.