An account was mapped for logon by a package other than Kerberos or NTLM.
Rarely significant. May indicate use of alternate authentication packages.
Low priority. Monitor for unexpected authentication packages in the PackageName field.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4774 // An account was mapped for logon
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4774
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# An account was mapped for logon — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`An account was mapped for logon. An account was mapped for logon by a package other than Kerberos or NTLM.
Event 4774 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Kerberos Authentication Service' subcategory (Success and/or Failure).
Low priority. Monitor for unexpected authentication packages in the PackageName field.