low
advisory
Windows Security: Detecting Logon Type 9
This detection identifies Windows logon events of type 9, which specify new credentials.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Low
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 11, 09:23 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
This rule monitors for Windows Security Event ID 4624 with Logon Type 9. This logon type indicates the use of new credentials.
Recommendation
Monitor for instances of Logon Type 9. Note that this activity may also be associated with legitimate remote administration.
Impact
This activity is associated with lateral movement techniques (T1550).
Detection coverage 1
Detect Outgoing Logon with New Credentials (Logon Type 9)
lowDetects Windows logon events of type 9, which specify new credentials.
sigma
tactics: lateral-movement
techniques: T1550
sources: windows, security
Detection queries are available on the platform. Get full rules →