Security

Event ID 4624: Successful logon

An account was successfully logged onSecurity event 4624 records every successful logon: who, how (LogonType), from where (IpAddress) and with which package. The core of logon forensics.

4624

Event ID: 4624
Channel: Security
Provider: Microsoft-Windows-Security-Auditing
Log file: Security.evtx
Category: Logon
Default logging: Logged by default

What event 4624 means

Event 4624 is written by the Local Security Authority on the computer that accepted the logon, each time a logon session is created. That makes it the machine-side record of access: the domain controller sees the authentication (4768, 4769, 4776), while the target host writes 4624.

The record answers four questions. Who: TargetUserName, TargetDomainName and TargetUserSid. How: LogonType, LogonProcessName and AuthenticationPackageName. From where: WorkstationName, IpAddress and IpPort. Which session: TargetLogonId, the key that ties the logon to everything done in it (4672, 4688, 4663, 4634/4647).

On a busy server 4624 is the noisiest event in the Security log — most records are services, machine accounts (names ending in $) and SYSTEM. Filter those out first, then group by LogonType and source.

When it is logged

Audit policy / configuration

Advanced Audit Policy Configuration > Logon/Logoff > Audit Logon (Success). Enabled for Success in the default Windows audit policy.

Network information (IpAddress, IpPort) is only filled for remote logons; local logons show - or 127.0.0.1. The ImpersonationLevel, RestrictedAdminMode, VirtualAccount, ElevatedToken and TargetLinkedLogonId fields appear on Windows 10 / Server 2016 and later.

Key fields

Field What it tells you

SubjectUserName Account that requested the logon on the local machine — usually the computer account (HOST$) or - for network logons. Not the account that logged on.

SubjectLogonId Logon session of the requester; 0x3e7 is the local SYSTEM session.

TargetUserName The account that was logged on. Check this, not the Subject fields.

TargetDomainName Domain or computer name of the target account.

TargetUserSid SID of the logged-on account. Stable even if the account is renamed.

TargetLogonId Hexadecimal ID of the new logon session. Pivot on it to find the matching 4672, the processes created in the session (4688 SubjectLogonId) and the logoff (4634, 4647).

LogonType

How the logon happened. Read this field first.

Value	Meaning
2	Interactive — keyboard and screen at the console (or KVM / hypervisor console).
3	Network — access to a resource over the network: SMB share, remote registry, WMI, WinRM, PsExec. No credentials are cached on the target.
4	Batch — scheduled task running as a user.
5	Service — a service started under a service account.
7	Unlock — workstation unlocked.
8	NetworkCleartext — network logon where the password was sent in clear text (IIS Basic authentication, some PowerShell/WinRM setups).
9	NewCredentials — `runas /netonly` or a process given alternate credentials for outbound connections only. The local identity stays the same.
10	RemoteInteractive — Remote Desktop / Terminal Services logon.
11	CachedInteractive — interactive logon with cached domain credentials (no DC reachable).

LogonProcessName Trusted logon process that handled the request, e.g. User32 (interactive/RDP), NtLmSsp (NTLM network logon), Kerberos, Advapi (services, runas), seclogo (runas / NewCredentials).

AuthenticationPackageName Kerberos, NTLM or Negotiate. NTLM network logons from workstations where Kerberos was expected deserve a second look.

LmPackageName For NTLM logons, the protocol version: NTLM V1, NTLM V2 or LM. NTLMv1 and LM are weak and should not appear in a modern domain.

KeyLength Session key length for NTLM; 0 for Kerberos and for NTLM without session security.

WorkstationName NetBIOS name of the source computer as supplied by the client (can be spoofed or empty).

IpAddress Source IP of a remote logon. - or ::1 / 127.0.0.1 for local logons.

IpPort Source TCP port; 0 or - for local logons.

ProcessName Process that performed the logon, e.g. C:\Windows\System32\winlogon.exe for interactive logons, services.exe for service logons, - for network logons.

ElevatedToken %%1842 (Yes) when the session received a full administrative token, %%1843 (No) otherwise. A quick way to spot admin logons.

RestrictedAdminMode For LogonType 10, whether the RDP client used Restricted Admin mode (no credentials sent to the server). %%1843 (No) or %%1842 (Yes).

VirtualAccount Yes for virtual accounts such as NT SERVICE\... managed service identities.

TargetLinkedLogonId With UAC, an administrator logon creates two linked sessions (filtered and elevated); this is the ID of the other one.

Common benign sources

Users signing in at the console (type 2), unlocking (type 7) or connecting over RDP (type 10).
Machine accounts (HOST$) and SYSTEM, LOCAL SERVICE, NETWORK SERVICE logons, especially type 5.
File server and domain controller traffic — thousands of type 3 logons per hour from workstations.
Scheduled tasks (type 4) and IIS application pools using configured accounts.
Administrators using runas /netonly (type 9) for tools that need other credentials.

What attackers do that produces it

Lateral movement with stolen credentials: type 3 logons from a workstation to servers (PsExec, SMB, WMI), often with a burst of new source/target pairs.
RDP access (type 10) from unusual IP addresses, at unusual times, or to hosts the account never uses.
Pass-the-hash: NTLM type 3 logons where Kerberos is expected. On the source host, Mimikatz sekurlsa::pth shows up as type 9 with LogonProcessName seclogo.
A successful logon right after many 4625 failures for the same account (brute force or password spraying that worked).
Logons by freshly created accounts (4720) or accounts that were just added to an admin group (4732, 4728).

Investigation tips

Filter out noise first: TargetUserName ending in $, SYSTEM, ANONYMOUS LOGON (unless you hunt null sessions) and LogonType 5.
Group by TargetUserName, LogonType and IpAddress to spot first-seen combinations.
Pivot on TargetLogonId: 4672 in the same second means an admin session; 4688 with the same SubjectLogonId lists what the session executed; 4634/4647 gives the session end.
For type 10, correlate with RDP events 1149, 21, 22, 24 and 25 to get the full session timeline.
On domain controllers, match type 3 logons with 4768/4769 (Kerberos) or 4776 (NTLM) to confirm which protocol was really used.

MITRE ATT&CK techniques

Technique	Tactics
T1078 Valid Accounts	Stealth, Persistence, Privilege Escalation, Initial Access
T1021.001 Remote Services: Remote Desktop Protocol	Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin Shares	Lateral Movement
T1550.002 Use Alternate Authentication Material: Pass the Hash	Lateral Movement

MITRE ATT&CK v19.2. Technique and tactic names are MITRE's.

Sigma rules for this event

14 SigmaHQ detection rules (release r2026-07-01) target this event.

Critical · 1
High · 7
Medium · 3
Low · 3

CriticalDiagTrackEoP Default Login UsernameRule by Nasreddine Bencherchali (Nextron Systems), SigmaHQ, DRL 1.1
HighExternal Remote SMB Logon from Public IPRule by Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity), SigmaHQ, DRL 1.1
HighHacktool RulerRule by Florian Roth (Nextron Systems), SigmaHQ, DRL 1.1
HighMetasploit SMB AuthenticationRule by Chakib Gzenayi (@Chak092), Hosni Mribah, SigmaHQ, DRL 1.1
HighPotential Privilege Escalation via Local Kerberos Relay over LDAPRule by Elastic, @SBousseaden, SigmaHQ, DRL 1.1
HighRDP Login from LocalhostRule by Thomas Patzke, SigmaHQ, DRL 1.1
HighRottenPotato Like Attack PatternRule by @SBousseaden, Florian Roth, SigmaHQ, DRL 1.1
HighSuccessful Overpass the Hash AttemptRule by Roberto Rodriguez (source), Dominik Schaudel (rule), SigmaHQ, DRL 1.1
MediumExternal Remote RDP Logon from Public IPRule by Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity), SigmaHQ, DRL 1.1
MediumPass the Hash Activity 2Rule by Dave Kennedy, Jeff Warren (method) / David Vassallo (rule), SigmaHQ, DRL 1.1
MediumPotential Access Token AbuseRule by Michaela Adams, Zach Mathis, SigmaHQ, DRL 1.1
LowAdmin User Remote LogonRule by juju4, SigmaHQ, DRL 1.1
LowOutgoing Logon with New CredentialsRule by Max Altgelt (Nextron Systems), SigmaHQ, DRL 1.1
LowSuccessful Account Login Via WMIRule by Thomas Patzke, SigmaHQ, DRL 1.1

Rules by their named authors, published by SigmaHQ under the Detection Rule License (DRL) 1.1.

Run these rules on your logs

Drop a .evtx file into the viewer: all 2,395 bundled SigmaHQ rules run locally in your browser. Nothing is uploaded.

Open the viewer Filter a log on event 4624

In-depth guideEvent ID 4624 explained: Windows successful logon and LogonType reference