Detection rules › By eventMicrosoft-Windows-Security-Auditing event 46111 detection rule reference this event. View event page.Sigma (1)Register new Logon Process by Rubeus severity high T1558.003