EVID 4624 : Logon Event (Deutsch - Security)

Event Details

Event Type	Audit Logon
Event Description	4624(S) : An account was successfully logged on.
Event ID	4624

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
Provider	N/A	N/A
EventID	<vmid>	<vmid>
Version	N/A	N/A
Level	<severity>	<severity>
Task	N/A	<vendorinfo>
Opcode	N/A	N/A
Keywords	N/A	<result>
TimeCreated	N/A	N/A
EventRecordID	N/A	N/A
Correlation	N/A	N/A
Execution	<version>	N/A
Channel	N/A	N/A
Computer	<dname>	<dname>
EventData	<vendorinfo>	N/A
SubjectUserSid	N/A	N/A
SubjectUserName	N/A	N/A
SubjectDomainName	N/A	N/A
SubjectLogonId	N/A	N/A
TargetUserSid	N/A	N/A
TargetUserName	<login>, <tag2>	<login>, <tag1>
TargetDomainName	<domain>	<domainorigin>
TargetLogonId	<session>	<session>
LogonType	<sessiontype>, <tag3>	<sessiontype>, <tag2>
LogonProcessName	<command>	<object>
AuthenticationPackageName	N/A	<objectname>
WorkstationName	N/A	N/A
LogonGuid	N/A	N/A
TransmittedServices	N/A	N/A
LmPackageName	N/A	N/A
KeyLength	<size>	<size>
ProcessId	<processid>	<processid>
ProcessName	<process>	<process>
IpAddress	<sip>	<sip>
IpPort	<sport>	<sport>
Security Id	<group>, <account>, <login>	N/A
Sname	<sname>	N/A
N/A	<object>	N/A
N/A	<objectname>	N/A
N/A	<subject>	N/A
ImpersonationLevel	N/A	N/A
RestrictedAdminMode	N/A	N/A
TargetOutboundUserName	N/A	N/A
TargetOutboundDomainName	N/A	N/A
VirtualAccount	N/A	N/A
TargetLinkedLogonId	N/A	N/A
ElevatedToken	N/A	<tag3>

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Event	Classification
1004650	EVID 4624 : Login Event	Base Rule	Authentication Activity	Authentication Success
	EVID 4624 : System Logon Type 3	Sub Rule	Computer Logon	Authentication Success
	EVID 4624 : Anonymous Logon Type 3	Sub Rule	User Logon	Authentication Success
	EVID 4624 : User Logon Type 2	Sub Rule	User Logon	Authentication Success
	EVID 4624 : User Logon Type 7	Sub Rule	User Logon	Authentication Success
	EVID 4624 : User Logon Type 11	Sub Rule	User Logon	Authentication Success
	EVID 4624 : User Logon Type 10	Sub Rule	User Logon	Authentication Success
	EVID 4624 : User Logon Type 4	Sub Rule	User Logon	Authentication Success
	EVID 4624 : User Logon Type 8	Sub Rule	User Logon	Authentication Success
	EVID 4624 : User Logon Type 9	Sub Rule	User Logon	Authentication Success
	EVID 4624 : Administrator Logon Type 10	Sub Rule	User Logon	Authentication Success
	EVID 4624 : Administrator Logon Type 11	Sub Rule	User Logon	Authentication Success
	EVID 4624 : Administrator Logon Type 4	Sub Rule	User Logon	Authentication Success
	EVID 4624 : Administrator Logon Type 7	Sub Rule	User Logon	Authentication Success
	EVID 4624 : Administrator Logon Type 8	Sub Rule	User Logon	Authentication Success
	EVID 4624 : Administrator Logon Type 9	Sub Rule	User Logon	Authentication Success
	EVID 4624 : Administrator Logon Type 2	Sub Rule	User Logon	Authentication Success
	EVID 4624 : Anonymous Logon Type 10	Sub Rule	User Logon	Authentication Success
	EVID 4624 : Anonymous Logon Type 8	Sub Rule	User Logon	Authentication Success
	EVID 4624 : System Logon Type 10	Sub Rule	Computer Logon	Authentication Success
	EVID 4624 : System Logon Type 11	Sub Rule	Computer Logon	Authentication Success
	EVID 4624 : Anonymous Logon Type 9	Sub Rule	User Logon	Authentication Success
	EVID 4624 : System Logon Type 8	Sub Rule	Computer Logon	Authentication Success
	EVID 4624 : Anonymous Logon Type 2	Sub Rule	User Logon	Authentication Success
	EVID 4624 : System Logon Type 9	Sub Rule	Computer Logon	Authentication Success
	EVID 4624 : Anonymous Logon Type 7	Sub Rule	User Logon	Authentication Success
	EVID 4624 : System Logon Type 4	Sub Rule	Computer Logon	Authentication Success
	EVID 4624 : Anonymous Logon Type 4	Sub Rule	User Logon	Authentication Success
	EVID 4624 : Anonymous Logon Type 11	Sub Rule	User Logon	Authentication Success
	EVID 4624 : Anonymous Logon Type 2	Sub Rule	User Logon	Authentication Success
	EVID 4624 : Anonymous Logon Type 11	Sub Rule	User Logon	Authentication Success
	EVID 4624 : Anonymous Logon Type 10	Sub Rule	User Logon	Authentication Success
	EVID 4624 : System Logon Type 7	Sub Rule	Computer Logon	Authentication Success
	EVID 4624 : System Logon Type 2	Sub Rule	Computer Logon	Authentication Success
	EVID 4624 : Anonymous Logon Type 8	Sub Rule	User Logon	Authentication Success
	EVID 4624 : Anonymous Logon Type 9	Sub Rule	User Logon	Authentication Success
	EVID 4624 : Anonymous Logon Type 7	Sub Rule	User Logon	Authentication Success
	EVID 4624 : Anonymous Logon Type 4	Sub Rule	User Logon	Authentication Success
	EVID 4624 : System Logon Type 5	Sub Rule	Service Logon	Authentication Success
	EVID 4624 : Anonymous Logon Type 5	Sub Rule	Service Logon	Authentication Success
	EVID 4624 : Anonymous Logon Type 5	Sub Rule	Service Logon	Authentication Success
	EVID 4624 : Administrator Logon Type 5	Sub Rule	Service Logon	Authentication Success
	EVID 4624 : User Logon Type 5	Sub Rule	Service Logon	Authentication Success
	EVID 4624 : Administrator Logon Type 3	Sub Rule	User Logon	Authentication Success
	EVID 4624 : Authentication Success	Sub Rule	Authentication Activity	Authentication Success
	EVID 4624 : Anonymous Logon Type 3	Sub Rule	User Logon	Authentication Success
	EVID 4624 : User Logon Type 3	Sub Rule	User Logon	Authentication Success

LogRhythm Default v2.0

Regex ID	Rule Name	Rule Type	Common Event	Classification
1011067	V 2.0 : Successful Account Logon Events	Base Rule	General Authentication Event	Other Audit
	V 2.0 : EVID 4624 : Elevated Comp Logon Success	Sub Rule	Administration Session Started	Other Audit Success
	V 2.0 : EVID 4624 : Computer Logon Success	Sub Rule	Computer Logon	Authentication Success
	V 2.0 : EVID 4624 : Elevated User Logon Success	Sub Rule	Administration Session Started	Other Audit Success
	V 2.0 : EVID 4624 : Interactive User Logon Success	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Network User Logon Success	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Batch User Logon Success	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Service User Logon Success	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Workstation Unlocked	Sub Rule	Workstation Unlocked	Other Audit Success
	V 2.0 : EVID 4624 : Netwk Cleartext Usr Logon Succ	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : User New Logon Session Created	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Remote Intractv Usr Logon Succ	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Cachd Interactv Usr Logon Succ	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Administrator Logon Type 10	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Administrator Logon Type 11	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Administrator Logon Type 2	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Administrator Logon Type 3	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Administrator Logon Type 4	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Administrator Logon Type 7	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Administrator Logon Type 8	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Administrator Logon Type 9	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Administrator Logon Type 5	Sub Rule	Service Logon	Authentication Success
	V 2.0 : EVID 4624 : Anonymous Logon Type 10	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Anonymous Logon Type 11	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Anonymous Logon Type 2	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Anonymous Logon Type 3	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Anonymous Logon Type 4	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Anonymous Logon Type 7	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Anonymous Logon Type 8	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Anonymous Logon Type 9	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4624 : Anonymous Logon Type 5	Sub Rule	Service Logon	Authentication Success
	V 2.0 : EVID 4624 : System Logon Type 10	Sub Rule	Computer Logon	Authentication Success
	V 2.0 : EVID 4624 : System Logon Type 11	Sub Rule	Computer Logon	Authentication Success
	V 2.0 : EVID 4624 : System Logon Type 2	Sub Rule	Computer Logon	Authentication Success
	V 2.0 : EVID 4624 : System Logon Type 3	Sub Rule	Computer Logon	Authentication Success
	V 2.0 : EVID 4624 : System Logon Type 4	Sub Rule	Computer Logon	Authentication Success
	V 2.0 : EVID 4624 : System Logon Type 7	Sub Rule	Computer Logon	Authentication Success
	V 2.0 : EVID 4624 : System Logon Type 8	Sub Rule	Computer Logon	Authentication Success
	V 2.0 : EVID 4624 : System Logon Type 9	Sub Rule	Computer Logon	Authentication Success
	V 2.0 : EVID 4624 : System Logon Type 5	Sub Rule	Service Logon	Authentication Success