detection.wiki

Defender-DeviceLogonEvents

ActionTypeTitleSampleRule
anyLogon activityYY
LogonSuccessLogon succeededYY
LogonFailedLogon failedYY
LogonAttemptedLogon attempt outcome (derived)YN

any: Logon activity

#
Table
DeviceLogonEvents

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

NameRulesVendors
AccountName2 detection rulesKusto
RemoteIP2 detection rulesKusto
Protocol1 detection ruleKusto

Example Event #

{
  "AccountDomain": "ludus.domain",
  "AccountName": "jd-dc01-2022$",
  "ActionType": "LogonAttempted",
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "jd-dc01-2022$",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "taskhostw.exe SYSTEM",
  "InitiatingProcessCreationTime": "2026-08-01T09:02:28.5940585Z",
  "InitiatingProcessFileName": "taskhostw.exe",
  "InitiatingProcessFileSize": 113136,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\taskhostw.exe",
  "InitiatingProcessId": 9424,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "e890d9a2ddcbc873e135294daede01f4",
  "InitiatingProcessParentCreationTime": "2026-08-01T01:02:17.7717067Z",
  "InitiatingProcessParentFileName": "\\Device\\HarddiskVolume1\\Windows\\System32\\svchost.exe",
  "InitiatingProcessParentId": 2616,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "6ad8ce3f2b7a377c3ad27a45cf1659dbbecb470c",
  "InitiatingProcessSHA256": "45d8d8c878be23e1a41509ff0139dc3aa107956365f75b0f752e8b162357c2eb",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "7318349394480636",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host Process for Windows Tasks",
  "InitiatingProcessVersionInfoInternalFileName": "taskhostw.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "taskhostw.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.20348.3451",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LogonType": "Unknown",
  "RemoteIP": "-",
  "ReportId": 1057950,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T09:02:29.1243928Z"
}

Detection Patterns #

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

FieldKindValueRulesVendors
ActionType (kusto rule field)eqListeningConnectionCreated1 rulekusto
DestinationIp (kusto rule field)is_not_null1 rulekusto
Protocol (kusto rule field)eqNTLM1 rulekusto
user (kusto rule field)ends_with$1 rulekusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

  • Password Spray source: Below queries detect password spray attacks using sliding window count plugin. Because of implementation of the sliding window, queries work better than the bin() usage, but may create duplicate alerts. Grouping can be used in such cases. Sentinel Query:
  • Potential NTLM Relay Attack to Domain Controller source: Below query detects NTLM authentication coming from Domain Controller machine accounts. This is not an expected behavior and it's an indication of NTLM relay attack.
    If NTLM Relaying is done towards a Linux machine, this query won't detect that. The attacker must have access to a Linux device in that case though.
  • Detection Opportunities for Certighost (CVE-2026-54121) source

LogonSuccess: Logon succeeded

#
Table
DeviceLogonEvents

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

NameRulesVendors
ActionType6 detection rulesKusto
LogonType5 detection rulesKusto
RemoteIP4 detection rulesKusto
RemoteIPType3 detection rulesKusto
Protocol2 detection rulesKusto
RemoteDeviceName2 detection rulesKusto
AccountDomain1 detection ruleKusto
AccountName1 detection ruleKusto
AdditionalFields1 detection ruleKusto
DeviceName1 detection ruleKusto
IsLocalAdmin1 detection ruleKusto

Example Event #

{
  "AccountDomain": "ludus",
  "AccountName": "jd-win11-22h2-1$",
  "AccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1106",
  "ActionType": "LogonSuccess",
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "None",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LogonId": 98224038,
  "LogonId@odata.type": "#Int64",
  "LogonType": "Network",
  "Protocol": "Kerberos",
  "RemoteIP": "10.2.10.21",
  "RemoteIPType": "Private",
  "RemotePort": 50341,
  "ReportId": 1060925,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T09:30:44.2019888Z"
}

Detection Patterns #

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

FieldKindValueRulesVendors
ActionType (kusto rule field)eqLogonSuccess5 ruleskusto
ActionType (kusto rule field)eqPowerShellCommand1 rulekusto
LogonType (kusto rule field)eqNetwork3 ruleskusto
LogonType (kusto rule field)inRemoteInteractive1 rulekusto
LogonType (kusto rule field)inUnlock1 rulekusto
RemoteIPType (kusto rule field)neLoopback3 ruleskusto
Protocol (kusto rule field)eqNTLM2 ruleskusto
RemoteDeviceName (kusto rule field)is_not_null2 ruleskusto
DestinationPort (kusto rule field)in4451 rulekusto
DestinationPort (kusto rule field)in801 rulekusto
TargetDomainName (kusto rule field)incontoso1 rulekusto
TargetDomainName (kusto rule field)incontoso.local1 rulekusto
TargetDomainName (kusto rule field)input your ad domains here!1 rulekusto
parent_process_name (kusto rule field)eqwsmprovhost.exe1 rulekusto
subnet (kusto rule field)is_null1 rulekusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

LogonFailed: Logon failed

#
Table
DeviceLogonEvents

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

NameRulesVendors
ActionType1 detection ruleKusto
LogonType1 detection ruleKusto
RemoteDeviceName1 detection ruleKusto
RemoteIP1 detection ruleKusto
RemoteIPType1 detection ruleKusto

Example Event #

{
  "AccountDomain": "jd-win11-22h2-1",
  "AccountName": "dwh_sec_u1",
  "ActionType": "LogonFailed",
  "AdditionalFields": {
    "IsLocalLogon": true
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FailureReason": "InvalidUserNameOrPassword",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountObjectId": "11111111-1111-1111-1111-111111111111",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessAccountUpn": "adminuser@example.onmicrosoft.com",
  "InitiatingProcessCommandLine": "wsmprovhost.exe -Embedding",
  "InitiatingProcessCreationTime": "2026-08-01T08:19:24.3062443Z",
  "InitiatingProcessFileName": "wsmprovhost.exe",
  "InitiatingProcessFileSize": 65536,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\wsmprovhost.exe",
  "InitiatingProcessId": 9640,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "High",
  "InitiatingProcessMD5": "378e99507c40ac1c4efa6d37a71ac706",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:36.1647611Z",
  "InitiatingProcessParentFileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\svchost.exe",
  "InitiatingProcessParentId": 1288,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "004164018d758153f077ae1d2c67218369e5847b",
  "InitiatingProcessSHA256": "d26f9ebb5c3fbae69495bb7f0fcc55652c2229092ed3d3b4c936c851524aae9a",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184873556",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host process for WinRM plug-ins",
  "InitiatingProcessVersionInfoInternalFileName": "wsmprovhost.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "wsmprovhost.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.2506",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LogonType": "Network",
  "Protocol": "Negotiate",
  "ReportId": 5898,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:19:31.8545225Z"
}

Detection Patterns #

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

FieldKindValueRulesVendors
RemoteIPType (kusto rule field)neLoopback1 rulekusto

LogonAttempted: Logon attempt outcome (derived)

#
Table
DeviceLogonEvents

Example Event #

{
  "AccountDomain": "ludus.domain",
  "AccountName": "jd-dc01-2022$",
  "ActionType": "LogonAttempted",
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "jd-dc01-2022$",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "taskhostw.exe SYSTEM",
  "InitiatingProcessCreationTime": "2026-08-01T09:02:28.5940585Z",
  "InitiatingProcessFileName": "taskhostw.exe",
  "InitiatingProcessFileSize": 113136,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\taskhostw.exe",
  "InitiatingProcessId": 9424,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "e890d9a2ddcbc873e135294daede01f4",
  "InitiatingProcessParentCreationTime": "2026-08-01T01:02:17.7717067Z",
  "InitiatingProcessParentFileName": "\\Device\\HarddiskVolume1\\Windows\\System32\\svchost.exe",
  "InitiatingProcessParentId": 2616,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "6ad8ce3f2b7a377c3ad27a45cf1659dbbecb470c",
  "InitiatingProcessSHA256": "45d8d8c878be23e1a41509ff0139dc3aa107956365f75b0f752e8b162357c2eb",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "7318349394480636",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host Process for Windows Tasks",
  "InitiatingProcessVersionInfoInternalFileName": "taskhostw.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "taskhostw.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.20348.3451",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LogonType": "Unknown",
  "RemoteIP": "-",
  "ReportId": 1057950,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T09:02:29.1243928Z"
}

References #