Event ID 4624: successful logon
What Event ID 4624 (successful logon) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.
Every successful logon on a Windows machine writes Event ID 4624. On a busy server that means thousands an hour, so the skill is not finding 4624s but knowing which few matter. The logon type, the source address and what happened just before are what separate a user opening a file share from an attacker moving between hosts.
The fields that matter
| Field | What it tells you |
|---|---|
| Logon Type | How the logon happened: 2 at the keyboard, 3 over the network (file shares, most remote tools), 10 RDP, 9 runas /netonly, 5 service, 4 scheduled task. |
| New Logon > Account Name / Domain | The account that logged on. Ignore the Subject section, which is usually the local system. |
| Logon ID | Ties this logon to 4672 (admin rights), 4634 (logoff) and the processes the session started. |
| Source Network Address | Where the logon came from. - or 127.0.0.1 means local. |
| Logon Process / Authentication Package | Kerberos, NTLM or Negotiate. NTLM where you expect Kerberos is worth a second look. |
| Elevated Token | Yes means the session has full admin rights. |
What is normal
Type 3 logons from file servers and domain controllers, machine accounts (names ending in $), type 5 for services and type 2 or 11 for people at their own laptops.
When Event ID 4624 is suspicious
- Type 10 (RDP) or type 3 from a public IP address: a service is exposed to the internet.
- A 4624 right after a burst of 4625 failures for the same account: treat the password as compromised.
- One source logging on with type 3 and NTLM to many hosts in a few minutes: lateral movement.
- Type 9 with logon process
seclogoand packageNegotiate: the pattern pass-the-hash tools leave. - A service or admin account logging on interactively to a workstation it never uses.
Common false positive: Vulnerability scanners and backup software produce large bursts of type 3 logons from one host. Put their addresses on a list before you alert on volume.
Find Event ID 4624 with PowerShell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
ForEach-Object {
$d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
[pscustomobject]$d
} | Format-ListMicrosoft Sentinel (KQL)
SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 4624
| project TimeGenerated, Computer, Account, Activity, EventData
| order by TimeGenerated descRelated events
- Event ID 4625: Failed logon
- Event ID 4672: Special privileges assigned to new logon
- Event ID 4648: Logon with explicit credentials
- Event ID 4634: Logoff
For a full walk-through, read Windows logon types explained.
FAQ
Why are there so many 4624 events with logon type 3?
Every file share access, Group Policy refresh and many management tools create a network logon. Filter out machine accounts and known servers first; what remains is usually small enough to read.
What is logon type 9?
NewCredentials: a process runs with a second set of credentials for network access only, as runas /netonly does. It is rare in normal use, which makes it a useful signal for pass-the-hash.
Windows Event Triage reads a CSV, EVTX-to-JSON or XML export in your browser and flags brute force, new admins, suspicious services and log clearing.
IOC Triage, our free browser extension: right-click it for a verdict from 15 threat-intel sources, then copy a ready ticket note.