Message

Windows is starting up.

This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.

Example Event

system:
  provider: Microsoft-Windows-Security-Auditing
  guid: 54849625-5478-4994-A5BA-3E3B0328C30D
  event_source_name: ''
  event_id: 4608
  version: 0
  level: 0
  task: 12288
  opcode: 0
  keywords: 9232379236109516800
  time_created: '2023-11-06T06:25:27.349587+00:00'
  event_record_id: 2754
  correlation: {}
  execution:
    process_id: 808
    thread_id: 812
  channel: Security
  computer: WinDev2310Eval
  security:
    user_id: ''
event_data: {}
message: ''

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4608
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4608
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

Windows is shutting down.
All logon sessions will be terminated by this shutdown.

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4609
• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-security-state-change
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4609

Message

An authentication package has been loaded by the Local Security Authority.
This authentication package will be used to authenticate logon attempts.

Authentication Package Name:	%1

Fields

Example Event

system:
  provider: Microsoft-Windows-Security-Auditing
  guid: 54849625-5478-4994-A5BA-3E3B0328C30D
  event_source_name: ''
  event_id: 4610
  version: 0
  level: 0
  task: 12289
  opcode: 0
  keywords: 9232379236109516800
  time_created: '2022-04-04T13:11:13.483248+00:00'
  event_record_id: 25342
  correlation:
    ActivityID: 7377737E-4825-0000-C974-77732548D801
  execution:
    process_id: 612
    thread_id: 616
  channel: Security
  computer: WIN-TKC15D7KHUR
  security:
    user_id: ''
event_data:
  AuthenticationPackageName: 'C:\Windows\system32\msv1_0.DLL : MICROSOFT_AUTHENTICATION_PACKAGE_V1_0'
message: ''

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4610
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4610
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

A trusted logon process has been registered with the Local Security Authority.
This logon process will be trusted to submit logon requests.

Subject:
	Security ID:		%1
	Account Name:		%2
	Account Domain:		%3
	Logon ID:		%4

Logon Process Name:		%5

Fields

Example Event

system:
  provider: Microsoft-Windows-Security-Auditing
  guid: 54849625-5478-4994-A5BA-3E3B0328C30D
  event_source_name: ''
  event_id: 4611
  version: 0
  level: 0
  task: 12289
  opcode: 0
  keywords: 9232379236109516800
  time_created: '2022-04-04T13:50:33.878854+00:00'
  event_record_id: 31791
  correlation:
    ActivityID: 7377737E-4825-0000-C974-77732548D801
  execution:
    process_id: 612
    thread_id: 3232
  channel: Security
  computer: WIN-TKC15D7KHUR
  security:
    user_id: ''
event_data:
  SubjectUserSid: S-1-5-18
  SubjectUserName: WIN-TKC15D7KHUR$
  SubjectDomainName: WORKGROUP
  SubjectLogonId: '0x3e7'
  LogonProcessName: UserManager
message: ''

Community Notes

Sigma Rules

• Register new Logon Process by Rubeus
  Detects potential use of Rubeus via registered new trusted logon process

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4611
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4611
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.

Number of audit messages discarded:	%1

This event is generated when audit queues are filled and events must be discarded.  This most commonly occurs when security events are being generated faster than they are being written to disk, or when the auditing system loses connectivity to the event log, such as when the event log service is stopped.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4612
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4612

Message

A notification package has been loaded by the Security Account Manager.
This package will be notified of any account or password changes.

Notification Package Name:	%1

Fields

Example Event

system:
  provider: Microsoft-Windows-Security-Auditing
  guid: 54849625-5478-4994-A5BA-3E3B0328C30D
  event_source_name: ''
  event_id: 4614
  version: 0
  level: 0
  task: 12289
  opcode: 0
  keywords: 9232379236109516800
  time_created: '2022-04-04T13:11:13.532261+00:00'
  event_record_id: 25349
  correlation:
    ActivityID: 7377737E-4825-0000-C974-77732548D801
  execution:
    process_id: 612
    thread_id: 616
  channel: Security
  computer: WIN-TKC15D7KHUR
  security:
    user_id: ''
event_data:
  NotificationPackageName: scecli
message: ''

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4614
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4614
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

Invalid use of LPC port.

Subject:
	Security ID:		%1
	Account Name:		%2
	Account Domain:		%3
	Logon ID:		%4

Process Information:
	PID:			%7
	Name:			%8

Invalid Use:		%5

LPC Server Port Name:	%6

Windows Local Security Authority (LSA) communicates with the Windows kernel using Local Procedure Call (LPC) ports. If you see this event, an application has inadvertently or intentionally accessed this port which is reserved exclusively for LSA's use. The application (process) should be investigated to ensure that it is not attempting to tamper with this communications channel.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4615
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4615

Message

The system time was changed.

Subject:
	Security ID:		%1
	Account Name:		%2
	Account Domain:		%3
	Logon ID:		%4

Process Information:
	Process ID:	%9
	Name:		%10

Previous Time:		%6 %5
New Time:		%8 %7

This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.

Fields

Example Event

system:
  provider: Microsoft-Windows-Security-Auditing
  guid: 54849625-5478-4994-A5BA-3E3B0328C30D
  event_source_name: ''
  event_id: 4616
  version: 1
  level: 0
  task: 12288
  opcode: 0
  keywords: 9232379236109516800
  time_created: '2023-11-05T22:32:22.236565+00:00'
  event_record_id: 3458
  correlation: {}
  execution:
    process_id: 4
    thread_id: 52
  channel: Security
  computer: WinDev2310Eval
  security:
    user_id: ''
event_data:
  SubjectUserSid: S-1-5-18
  SubjectUserName: WINDEV2310EVAL$
  SubjectDomainName: WORKGROUP
  SubjectLogonId: '0x3e7'
  PreviousTime: '2023-11-05T22:32:20.942615Z'
  NewTime: '2023-11-05T22:32:22.232000Z'
  ProcessId: '0xcec'
  ProcessName: C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
message: ''

Sigma Rules

• Unauthorized System Time Modification
  Detect scenarios where a potentially unauthorized application or user is modifying the system time.

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4616
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4616
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

A monitored security event pattern has occurred.

Subject:
	Security ID:		%3
	Account Name:		%4
	Account Domain:		%5
	Logon ID:		%6

Alert Information:
	Computer:		%2
	Event ID:		%1
	Number of Events:	%7
	Duration:		%8

This event is generated when Windows is configured to generate alerts in accordance with the Common Criteria Security Audit Analysis requirements (FAU_SAA) and an auditable event pattern occurs.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4618
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4618

Message

Administrator recovered system from CrashOnAuditFail. Users who are not administrators will now be allowed to log on. Some auditable activity might not have been recorded.

Value of CrashOnAuditFail:	%1

This event is logged after a system reboots following CrashOnAuditFail.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4621
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4621

Message

A security package has been loaded by the Local Security Authority.

Security Package Name:	%1

Fields

Example Event

system:
  provider: Microsoft-Windows-Security-Auditing
  guid: 54849625-5478-4994-A5BA-3E3B0328C30D
  event_source_name: ''
  event_id: 4622
  version: 0
  level: 0
  task: 12289
  opcode: 0
  keywords: 9232379236109516800
  time_created: '2022-04-04T13:11:13.482782+00:00'
  event_record_id: 25341
  correlation:
    ActivityID: 7377737E-4825-0000-C974-77732548D801
  execution:
    process_id: 612
    thread_id: 616
  channel: Security
  computer: WIN-TKC15D7KHUR
  security:
    user_id: ''
event_data:
  SecurityPackageName: 'C:\Windows\system32\schannel.DLL : Microsoft Unified Security
    Protocol Provider'
message: ''

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4622
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4622
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

An account was successfully logged on.

Subject:
	Security ID:		%1
	Account Name:		%2
	Account Domain:		%3
	Logon ID:		%4

Logon Type:			%9

New Logon:
	Security ID:		%5
	Account Name:		%6
	Account Domain:		%7
	Logon ID:		%8
	Logon GUID:		%13

Process Information:
	Process ID:		%17
	Process Name:		%18

Network Information:
	Workstation Name:	%12
	Source Network Address:	%19
	Source Port:		%20

Detailed Authentication Information:
	Logon Process:		%10
	Authentication Package:	%11
	Transited Services:	%14
	Package Name (NTLM only):	%15
	Key Length:		%16

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

Fields

Example Event

system:
  provider: Microsoft-Windows-Security-Auditing
  guid: 54849625-5478-4994-A5BA-3E3B0328C30D
  event_source_name: ''
  event_id: 4624
  version: 3
  level: 0
  task: 12544
  opcode: 0
  keywords: 9232379236109516800
  time_created: '2023-11-06T06:25:52.440978+00:00'
  event_record_id: 2948
  correlation:
    ActivityID: F590C418-1079-0001-5BC5-90F57910DA01
  execution:
    process_id: 808
    thread_id: 856
  channel: Security
  computer: WinDev2310Eval
  security:
    user_id: ''
event_data:
  SubjectUserSid: S-1-5-18
  SubjectUserName: WINDEV2310EVAL$
  SubjectDomainName: WORKGROUP
  SubjectLogonId: '0x3e7'
  TargetUserSid: S-1-5-18
  TargetUserName: SYSTEM
  TargetDomainName: NT AUTHORITY
  TargetLogonId: '0x3e7'
  LogonType: 5
  LogonProcessName: 'Advapi  '
  AuthenticationPackageName: Negotiate
  WorkstationName: '-'
  LogonGuid: 00000000-0000-0000-0000-000000000000
  TransmittedServices: '-'
  LmPackageName: '-'
  KeyLength: 0
  ProcessId: '0x30c'
  ProcessName: C:\Windows\System32\services.exe
  IpAddress: '-'
  IpPort: '-'
  ImpersonationLevel: '%%1833'
  RestrictedAdminMode: '-'
  RemoteCredentialGuard: '-'
  TargetOutboundUserName: '-'
  TargetOutboundDomainName: '-'
  VirtualAccount: '%%1843'
  TargetLinkedLogonId: '0x0'
  ElevatedToken: '%%1842'
message: ''

Community Notes

• LogonType 3 (Network) from localhost (127.0.0.1) may indicate service account activity or local COM activation rather than a true remote logon.
• LogonType 3 and 10 are indicators of remote access
• LogonType 3 and LogonProcess “NtLmSsp” may indicate an NTLM relay attack (correlate source IP with Event ID 8004 to find mismatches, check for Anonymous Logon user)
• LogonType 9 and Logon Process “seclogo” are common indicators of Pass-the-Hash

Sigma Rules

• Potential Access Token Abuse
  Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser" with the "LOGON32_LOGON_NEW_CREDENTIALS flag".
• Admin User Remote Logon
  Detect remote login by Administrator user (depending on internal pattern).
• DiagTrackEoP Default Login Username
  Detects the default "UserName" used by the DiagTrackEoP POC
• Successful Overpass the Hash Attempt
  Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module.
• Pass the Hash Activity 2
  Detects the attack technique pass the hash which is used to move laterally inside the network

Showing 5 of 14 matching Sigma rules.

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4624
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

An account failed to log on.

Subject:
	Security ID:		%1
	Account Name:		%2
	Account Domain:		%3
	Logon ID:		%4

Logon Type:			%11

Account For Which Logon Failed:
	Security ID:		%5
	Account Name:		%6
	Account Domain:		%7

Failure Information:
	Failure Reason:		%9
	Status:			%8
	Sub Status:		%10

Process Information:
	Caller Process ID:	%18
	Caller Process Name:	%19

Network Information:
	Workstation Name:	%14
	Source Network Address:	%20
	Source Port:		%21

Detailed Authentication Information:
	Logon Process:		%12
	Authentication Package:	%13
	Transited Services:	%15
	Package Name (NTLM only):	%16
	Key Length:		%17

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

Fields

Example Event

system:
  provider: Microsoft-Windows-Security-Auditing
  guid: 54849625-5478-4994-A5BA-3E3B0328C30D
  event_source_name: ''
  event_id: 4625
  version: 0
  level: 0
  task: 12544
  opcode: 0
  keywords: 9227875636482146304
  time_created: '2016-09-19T16:50:06.477878Z'
  event_record_id: 2455
  correlation:
    '#attributes':
      ActivityID: B864D168-0B7B-0000-89D1-64B87B0BD201
  execution:
    process_id: 752
    thread_id: 4068
  channel: Security
  computer: DESKTOP-M5SN04R
  security:
    user_id: ''
event_data:
  SubjectUserSid: S-1-0-0
  SubjectUserName: '-'
  SubjectDomainName: '-'
  SubjectLogonId: '0x0'
  TargetUserSid: S-1-0-0
  TargetUserName: JcDfcZTc
  TargetDomainName: .
  Status: '0xc000006d'
  FailureReason: '%%2313'
  SubStatus: '0xc0000064'
  LogonType: 3
  LogonProcessName: 'NtLmSsp '
  AuthenticationPackageName: NTLM
  WorkstationName: 6hgtmVlrrFuWtO65
  TransmittedServices: '-'
  LmPackageName: '-'
  KeyLength: 0
  ProcessId: '0x0'
  ProcessName: '-'
  IpAddress: 192.168.198.149
  IpPort: '50249'

Community Notes

Sigma Rules

• Failed Logon From Public IP
  Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.
• Hacktool Ruler
  This events that are generated when using the hacktool Ruler by Sensepost
• Metasploit SMB Authentication
  Alerts on Metasploit host's authentications on the domain.
• Account Tampering - Suspicious Failed Logon Reasons
  This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4625
• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Message

User / Device claims information.

Subject:
	Security ID:		%1
	Account Name:		%2
	Account Domain:		%3
	Logon ID:		%4

Logon Type:			%9

New Logon:
	Security ID:		%5
	Account Name:		%6
	Account Domain:		%7
	Logon ID:		%8

Event in sequence:		%10 of %11

User Claims:			%12

Device Claims:			%13

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

This event is generated when the Audit User/Device claims subcategory is configured and the user?s logon token contains user/device claims information. The Logon ID field can be used to correlate this event with the corresponding user logon event as well as to any other security audit events generated during this logon session.

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4626
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4626

Message

Group membership information.

Subject:
	Security ID:		%1
	Account Name:		%2
	Account Domain:		%3
	Logon ID:		%4

Logon Type:			%9

New Logon:
	Security ID:		%5
	Account Name:		%6
	Account Domain:		%7
	Logon ID:		%8

Event in sequence:		%10 of %11

Group Membership:			%12

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

This event is generated when the Audit Group Membership subcategory is configured.  The Logon ID field can be used to correlate this event with the corresponding user logon event as well as to any other security audit events generated during this logon session.

Fields

Example Event

system:
  provider: Microsoft-Windows-Security-Auditing
  guid: 54849625-5478-4994-A5BA-3E3B0328C30D
  event_source_name: ''
  event_id: 4627
  version: 0
  level: 0
  task: 12554
  opcode: 0
  keywords: 9232379236109516800
  time_created: '2023-11-06T02:00:32.200180+00:00'
  event_record_id: 310791
  correlation:
    ActivityID: E4DB489E-1037-0001-0C49-DBE43710DA01
  execution:
    process_id: 808
    thread_id: 16720
  channel: Security
  computer: WinDev2310Eval
  security:
    user_id: ''
event_data:
  SubjectUserSid: S-1-5-18
  SubjectUserName: WINDEV2310EVAL$
  SubjectDomainName: WORKGROUP
  SubjectLogonId: '0x3e7'
  TargetUserSid: S-1-5-18
  TargetUserName: SYSTEM
  TargetDomainName: NT AUTHORITY
  TargetLogonId: '0x3e7'
  LogonType: 5
  EventIdx: 1
  EventCountTotal: 1
  GroupMembership: "\r\n\t\t%{S-1-5-32-544}\r\n\t\t%{S-1-1-0}\r\n\t\t%{S-1-5-11}\r\n\t\t%{S-1-16-16384}"
message: ''

Community Notes

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4627
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4627
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

An account was logged off.

Subject:
	Security ID:		%1
	Account Name:		%2
	Account Domain:		%3
	Logon ID:		%4

Logon Type:			%5

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.

Fields

Example Event

system:
  provider: Microsoft-Windows-Security-Auditing
  guid: 54849625-5478-4994-A5BA-3E3B0328C30D
  event_source_name: ''
  event_id: 4634
  version: 0
  level: 0
  task: 12545
  opcode: 0
  keywords: 9232379236109516800
  time_created: '2023-10-25T22:56:14.242850+00:00'
  event_record_id: 2692
  correlation: {}
  execution:
    process_id: 824
    thread_id: 880
  channel: Security
  computer: WinDevEval
  security:
    user_id: ''
event_data:
  TargetUserSid: S-1-5-111-3847866527-469524349-687026318-516638107-1125189541-4560
  TargetUserName: sshd_4560
  TargetDomainName: VIRTUAL USERS
  TargetLogonId: '0x41a49'
  LogonType: 5
message: ''

Sigma Rules

• User Logoff Event
  Detects a user log-off activity. Could be used for example to correlate information during forensic investigations

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4634
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4634
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

%1

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4646
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4646

Message

User initiated logoff:

Subject:
	Security ID:		%1
	Account Name:		%2
	Account Domain:		%3
	Logon ID:		%4

This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.

Fields

Example Event

system:
  provider: Microsoft-Windows-Security-Auditing
  guid: 54849625-5478-4994-A5BA-3E3B0328C30D
  event_source_name: ''
  event_id: 4647
  version: 0
  level: 0
  task: 12545
  opcode: 0
  keywords: 9232379236109516800
  time_created: '2023-11-05T22:31:33.526113+00:00'
  event_record_id: 3363
  correlation:
    ActivityID: 59A0D65F-1037-0001-A7D6-A0593710DA01
  execution:
    process_id: 808
    thread_id: 8392
  channel: Security
  computer: WinDev2310Eval
  security:
    user_id: ''
event_data:
  TargetUserSid: S-1-5-21-1992711665-1655669231-58201500-1000
  TargetUserName: User
  TargetDomainName: WINDEV2310EVAL
  TargetLogonId: '0x580c6'
message: ''

Sigma Rules

• User Logoff Event
  Detects a user log-off activity. Could be used for example to correlate information during forensic investigations

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4647
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4647
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

A logon was attempted using explicit credentials.

Subject:
	Security ID:		%1
	Account Name:		%2
	Account Domain:		%3
	Logon ID:		%4
	Logon GUID:		%5

Account Whose Credentials Were Used:
	Account Name:		%6
	Account Domain:		%7
	Logon GUID:		%8

Target Server:
	Target Server Name:	%9
	Additional Information:	%10

Process Information:
	Process ID:		%11
	Process Name:		%12

Network Information:
	Network Address:	%13
	Port:			%14

This event is generated when a process attempts to log on an account by explicitly specifying that account?s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.

Fields

Example Event

system:
  provider: Microsoft-Windows-Security-Auditing
  guid: 54849625-5478-4994-A5BA-3E3B0328C30D
  event_source_name: ''
  event_id: 4648
  version: 0
  level: 0
  task: 12544
  opcode: 0
  keywords: 9232379236109516800
  time_created: '2023-11-06T06:25:29.161457+00:00'
  event_record_id: 2767
  correlation:
    ActivityID: F590C418-1079-0001-5BC5-90F57910DA01
  execution:
    process_id: 808
    thread_id: 856
  channel: Security
  computer: WinDev2310Eval
  security:
    user_id: ''
event_data:
  SubjectUserSid: S-1-5-18
  SubjectUserName: WINDEV2310EVAL$
  SubjectDomainName: WORKGROUP
  SubjectLogonId: '0x3e7'
  LogonGuid: 00000000-0000-0000-0000-000000000000
  TargetUserName: DWM-1
  TargetDomainName: Window Manager
  TargetLogonGuid: 00000000-0000-0000-0000-000000000000
  TargetServerName: localhost
  TargetInfo: localhost
  ProcessId: '0x2e0'
  ProcessName: C:\Windows\System32\winlogon.exe
  IpAddress: '-'
  IpPort: '-'
message: ''

Community Notes

Sigma Rules

• Suspicious Remote Logon with Explicit Credentials
  Detects suspicious processes logging on with explicit credentials

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4648
• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Message

A replay attack was detected.

Subject:
	Security ID:		%1
	Account Name:		%2
	Account Domain:		%3
	Logon ID:		%4

Credentials Which Were Replayed:
	Account Name:		%5
	Account Domain:		%6

Process Information:
	Process ID:		%12
	Process Name:		%13

Network Information:
	Workstation Name:	%10

Detailed Authentication Information:
	Request Type:		%7
	Logon Process:		%8
	Authentication Package:	%9
	Transited Services:	%11

This event indicates that a Kerberos replay attack was detected- a request was received twice with identical information. This condition could be caused by network misconfiguration.

Fields

Community Notes

Sigma Rules

• Replay Attack Detected
  Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4649
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4649

Message

An IPsec main mode security association was established. Extended mode was not enabled.  Certificate authentication was not used.

Local Endpoint:
	Principal Name:	%1
	Network Address:	%3
	Keying Module Port:	%4

Remote Endpoint:
	Principal Name:	%2
	Network Address:	%5
	Keying Module Port:	%6

Security Association Information:
	Lifetime (minutes):	%12
	Quick Mode Limit:	%13
	Main Mode SA ID:	%17

Cryptographic Information:
	Cipher Algorithm:	%9
	Integrity Algorithm:	%10
	Diffie-Hellman Group:	%11

Additional Information:
	Keying Module Name:	%7
	Authentication Method:	%8
	Role:	%14
	Impersonation State:	%15
	Main Mode Filter ID:	%16

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4650
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4650

Message

An IPsec main mode security association was established. Extended mode was not enabled.  A certificate was used for authentication.

Local Endpoint:
	Principal Name:	%1
	Network Address:	%9
	Keying Module Port:	%10

Local Certificate:
	SHA Thumbprint:	%2
	Issuing CA:		%3
	Root CA:		%4

Remote Endpoint:
	Principal Name:	%5
	Network Address:	%11
	Keying Module Port:	%12

Remote Certificate:
	SHA thumbprint: 	%6
	Issuing CA:		%7
	Root CA:		%8

Cryptographic Information:
	Cipher Algorithm:	%15
	Integrity Algorithm:	%16
	Diffie-Hellman Group:	%17

Security Association Information:
	Lifetime (minutes):	%18
	Quick Mode Limit:	%19
	Main Mode SA ID:	%23

Additional Information:
	Keying Module Name:	%13
	Authentication Method:	%14
	Role:	%20
	Impersonation State:	%21
	Main Mode Filter ID:	%22

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4651
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4651

Message

An IPsec main mode negotiation failed.


Local Endpoint:
	Principal Name:		%1
	Network Address:	%9
	Keying Module Port:	%10

Local Certificate:
	SHA Thumbprint:	%2
	Issuing CA:		%3
	Root CA:		%4

Remote Endpoint:
	Principal Name:		%5
	Network Address:	%11
	Keying Module Port:	%12

Remote Certificate:
	SHA thumbprint:		%6
	Issuing CA:		%7
	Root CA:		%8

Additional Information:
	Keying Module Name:	%13
	Authentication Method:	%16
	Role:			%18
	Impersonation State:	%19
	Main Mode Filter ID:	%20

Failure Information:
	Failure Point:		%14
	Failure Reason:		%15
	State:			%17
	Initiator Cookie:		%21
	Responder Cookie:	%22

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4652
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4652

Message

An IPsec main mode negotiation failed.

Local Endpoint:
	Local Principal Name:	%1
	Network Address:	%3
	Keying Module Port:	%4

Remote Endpoint:
	Principal Name:		%2
	Network Address:	%5
	Keying Module Port:	%6

Additional Information:
	Keying Module Name:	%7
	Authentication Method:	%10
	Role:			%12
	Impersonation State:	%13
	Main Mode Filter ID:	%14

Failure Information:
	Failure Point:		%8
	Failure Reason:		%9
	State:			%11
	Initiator Cookie:		%15
	Responder Cookie:	%16

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4653
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4653

Message

An IPsec quick mode negotiation failed.

Local Endpoint:
	Network Address:	%1
	Network Address mask:	%2
	Port:			%3
	Tunnel Endpoint:		%4

Remote Endpoint:
	Network Address:	%5
	Address Mask:		%6
	Port:			%7
	Tunnel Endpoint:		%8
	Private Address:		%10

Additional Information:
	Protocol:		%9
	Keying Module Name:	%11
	Mode:			%14
	Role:			%16
	Quick Mode Filter ID:	%18
	Main Mode SA ID:	%19

Failure Information:
	State:			%15
	Message ID:		%17
	Failure Point:		%12
	Failure Reason:		%13

Fields

References

• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4654
• Microsoft Learn https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4654

Message

An IPsec main mode security association ended.

Local Network Address:		%1
Remote Network Address:	%2
Keying Module Name:		%3
Main Mode SA ID:		%4

Fields

References

• Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4655
• Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4655

Message

A handle to an object was requested.

Subject:
	Security ID:		%1
	Account Name:		%2
	Account Domain:		%3
	Logon ID:		%4

Object:
	Object Server:		%5
	Object Type:		%6
	Object Name:		%7
	Handle ID:		%8

Process Information:
	Process ID:		%14
	Process Name:		%15

Access Request Information:
	Transaction ID:		%9
	Accesses:		%10
	Access Mask:		%11
	Privileges Used for Access Check:	%12
	Restricted SID Count:	%13

Fields