Defender-DeviceLogonEvents
| ActionType | Title | Sample | Rule | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Logon| Logon succeeded | Y | Y | Logon | Logon failed | Y | Y | Logon | Logon attempt outcome (derived) | Y | N | |
LogonSuccess: Logon succeeded
#Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.
| Name | Rules | Vendors |
|---|---|---|
ActionType | 6 detection rules | Kusto |
LogonType | 5 detection rules | Kusto |
RemoteIP | 4 detection rules | Kusto |
RemoteIPType | 3 detection rules | Kusto |
Protocol | 2 detection rules | Kusto |
RemoteDeviceName | 2 detection rules | Kusto |
AccountDomain | 1 detection rule | Kusto |
AccountName | 1 detection rule | Kusto |
AdditionalFields | 1 detection rule | Kusto |
DeviceName | 1 detection rule | Kusto |
IsLocalAdmin | 1 detection rule | Kusto |
Example Event #
{
"AccountDomain": "ludus",
"AccountName": "jd-win11-22h2-1$",
"AccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1106",
"ActionType": "LogonSuccess",
"DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
"DeviceName": "jd-dc01-2022.ludus.domain",
"InitiatingProcessId": 0,
"InitiatingProcessId@odata.type": "#Int64",
"InitiatingProcessParentId": 0,
"InitiatingProcessParentId@odata.type": "#Int64",
"InitiatingProcessSessionId": 0,
"InitiatingProcessSessionId@odata.type": "#Int64",
"InitiatingProcessTokenElevation": "None",
"InitiatingProcessUniqueId": "0",
"IsInitiatingProcessRemoteSession": 0,
"IsInitiatingProcessRemoteSession@odata.type": "#SByte",
"LogonId": 98224038,
"LogonId@odata.type": "#Int64",
"LogonType": "Network",
"Protocol": "Kerberos",
"RemoteIP": "10.2.10.21",
"RemoteIPType": "Private",
"RemotePort": 50341,
"ReportId": 1060925,
"ReportId@odata.type": "#Int64",
"Timestamp": "2026-08-01T09:30:44.2019888Z"
}
Detection Patterns #
Lateral Movement: Distributed Component Object Model
Defender-DeviceLogonEvents LogonSuccess: Logon succeededORDefender-IdentityInfo any: Identity information
1 rule
Credential Access: Name Resolution Poisoning and SMB Relay
Defender-DeviceLogonEvents LogonSuccess: Logon succeededORDefender-DeviceNetworkEvents any: Network activityORConnectionSuccess: Connection succeededORConnectionAttempt: Connection attempt
1 rule
Credential Access: Password Spraying
1 rule
Lateral Movement: Remote Desktop Protocol
Defender-DeviceLogonEvents LogonSuccess: Logon succeededORDefender-DeviceProcessEvents any: Process activity
1 rule
Lateral Movement: Exploitation of Remote Services
Defender-DeviceEvents PowerShellCommand: PowerShell command executedORDefender-DeviceLogonEvents LogonSuccess: Logon succeeded
1 rule
Common Indicators #
Positive field/value combinations most frequently checked by detection rules attached to this catalog entry, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
ActionType (kusto rule field) | eq | LogonSuccess | 1 rule | kusto |
Detection Rules #
Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →Kusto #
LogonFailed: Logon failed
#Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.
| Name | Rules | Vendors |
|---|---|---|
ActionType | 1 detection rule | Kusto |
LogonType | 1 detection rule | Kusto |
RemoteDeviceName | 1 detection rule | Kusto |
RemoteIP | 1 detection rule | Kusto |
RemoteIPType | 1 detection rule | Kusto |
Example Event #
{
"AccountDomain": "jd-win11-22h2-1",
"AccountName": "dwh_sec_u1",
"ActionType": "LogonFailed",
"AdditionalFields": {
"IsLocalLogon": true
},
"DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
"DeviceName": "jd-win11-22h2-1.ludus.domain",
"FailureReason": "InvalidUserNameOrPassword",
"InitiatingProcessAccountDomain": "ludus",
"InitiatingProcessAccountName": "domainadmin",
"InitiatingProcessAccountObjectId": "11111111-1111-1111-1111-111111111111",
"InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
"InitiatingProcessAccountUpn": "adminuser@example.onmicrosoft.com",
"InitiatingProcessCommandLine": "wsmprovhost.exe -Embedding",
"InitiatingProcessCreationTime": "2026-08-01T08:19:24.3062443Z",
"InitiatingProcessFileName": "wsmprovhost.exe",
"InitiatingProcessFileSize": 65536,
"InitiatingProcessFileSize@odata.type": "#Int64",
"InitiatingProcessFolderPath": "c:\\windows\\system32\\wsmprovhost.exe",
"InitiatingProcessId": 9640,
"InitiatingProcessId@odata.type": "#Int64",
"InitiatingProcessIntegrityLevel": "High",
"InitiatingProcessMD5": "378e99507c40ac1c4efa6d37a71ac706",
"InitiatingProcessParentCreationTime": "2026-08-01T00:56:36.1647611Z",
"InitiatingProcessParentFileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\svchost.exe",
"InitiatingProcessParentId": 1288,
"InitiatingProcessParentId@odata.type": "#Int64",
"InitiatingProcessSHA1": "004164018d758153f077ae1d2c67218369e5847b",
"InitiatingProcessSHA256": "d26f9ebb5c3fbae69495bb7f0fcc55652c2229092ed3d3b4c936c851524aae9a",
"InitiatingProcessSessionId": 0,
"InitiatingProcessSessionId@odata.type": "#Int64",
"InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
"InitiatingProcessUniqueId": "9851624184873556",
"InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
"InitiatingProcessVersionInfoFileDescription": "Host process for WinRM plug-ins",
"InitiatingProcessVersionInfoInternalFileName": "wsmprovhost.exe",
"InitiatingProcessVersionInfoOriginalFileName": "wsmprovhost.exe",
"InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
"InitiatingProcessVersionInfoProductVersion": "10.0.22621.2506",
"IsInitiatingProcessRemoteSession": 0,
"IsInitiatingProcessRemoteSession@odata.type": "#SByte",
"LogonType": "Network",
"Protocol": "Negotiate",
"ReportId": 5898,
"ReportId@odata.type": "#Int64",
"Timestamp": "2026-08-01T08:19:31.8545225Z"
}
Detection Patterns #
Credential Access: Password Spraying
1 rule
LogonAttempted: Logon attempt outcome (derived)
#Example Event #
{
"AccountDomain": "ludus.domain",
"AccountName": "jd-dc01-2022$",
"ActionType": "LogonAttempted",
"DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
"DeviceName": "jd-dc01-2022.ludus.domain",
"InitiatingProcessAccountDomain": "ludus",
"InitiatingProcessAccountName": "jd-dc01-2022$",
"InitiatingProcessAccountSid": "S-1-5-18",
"InitiatingProcessCommandLine": "taskhostw.exe SYSTEM",
"InitiatingProcessCreationTime": "2026-08-01T09:02:28.5940585Z",
"InitiatingProcessFileName": "taskhostw.exe",
"InitiatingProcessFileSize": 113136,
"InitiatingProcessFileSize@odata.type": "#Int64",
"InitiatingProcessFolderPath": "c:\\windows\\system32\\taskhostw.exe",
"InitiatingProcessId": 9424,
"InitiatingProcessId@odata.type": "#Int64",
"InitiatingProcessIntegrityLevel": "System",
"InitiatingProcessMD5": "e890d9a2ddcbc873e135294daede01f4",
"InitiatingProcessParentCreationTime": "2026-08-01T01:02:17.7717067Z",
"InitiatingProcessParentFileName": "\\Device\\HarddiskVolume1\\Windows\\System32\\svchost.exe",
"InitiatingProcessParentId": 2616,
"InitiatingProcessParentId@odata.type": "#Int64",
"InitiatingProcessSHA1": "6ad8ce3f2b7a377c3ad27a45cf1659dbbecb470c",
"InitiatingProcessSHA256": "45d8d8c878be23e1a41509ff0139dc3aa107956365f75b0f752e8b162357c2eb",
"InitiatingProcessSessionId": 0,
"InitiatingProcessSessionId@odata.type": "#Int64",
"InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
"InitiatingProcessUniqueId": "7318349394480636",
"InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
"InitiatingProcessVersionInfoFileDescription": "Host Process for Windows Tasks",
"InitiatingProcessVersionInfoInternalFileName": "taskhostw.exe",
"InitiatingProcessVersionInfoOriginalFileName": "taskhostw.exe",
"InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
"InitiatingProcessVersionInfoProductVersion": "10.0.20348.3451",
"IsInitiatingProcessRemoteSession": 0,
"IsInitiatingProcessRemoteSession@odata.type": "#SByte",
"LogonType": "Unknown",
"RemoteIP": "-",
"ReportId": 1057950,
"ReportId@odata.type": "#Int64",
"Timestamp": "2026-08-01T09:02:29.1243928Z"
}
any: Logon activity
#Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.
Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.
| Name | Rules | Vendors |
|---|---|---|
AccountName | 2 detection rules | Kusto |
RemoteIP | 2 detection rules | Kusto |
Protocol | 1 detection rule | Kusto |
Representative record #
{
"AccountDomain": "ludus.domain",
"AccountName": "jd-dc01-2022$",
"ActionType": "LogonAttempted",
"DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
"DeviceName": "jd-dc01-2022.ludus.domain",
"InitiatingProcessAccountDomain": "ludus",
"InitiatingProcessAccountName": "jd-dc01-2022$",
"InitiatingProcessAccountSid": "S-1-5-18",
"InitiatingProcessCommandLine": "taskhostw.exe SYSTEM",
"InitiatingProcessCreationTime": "2026-08-01T09:02:28.5940585Z",
"InitiatingProcessFileName": "taskhostw.exe",
"InitiatingProcessFileSize": 113136,
"InitiatingProcessFileSize@odata.type": "#Int64",
"InitiatingProcessFolderPath": "c:\\windows\\system32\\taskhostw.exe",
"InitiatingProcessId": 9424,
"InitiatingProcessId@odata.type": "#Int64",
"InitiatingProcessIntegrityLevel": "System",
"InitiatingProcessMD5": "e890d9a2ddcbc873e135294daede01f4",
"InitiatingProcessParentCreationTime": "2026-08-01T01:02:17.7717067Z",
"InitiatingProcessParentFileName": "\\Device\\HarddiskVolume1\\Windows\\System32\\svchost.exe",
"InitiatingProcessParentId": 2616,
"InitiatingProcessParentId@odata.type": "#Int64",
"InitiatingProcessSHA1": "6ad8ce3f2b7a377c3ad27a45cf1659dbbecb470c",
"InitiatingProcessSHA256": "45d8d8c878be23e1a41509ff0139dc3aa107956365f75b0f752e8b162357c2eb",
"InitiatingProcessSessionId": 0,
"InitiatingProcessSessionId@odata.type": "#Int64",
"InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
"InitiatingProcessUniqueId": "7318349394480636",
"InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
"InitiatingProcessVersionInfoFileDescription": "Host Process for Windows Tasks",
"InitiatingProcessVersionInfoInternalFileName": "taskhostw.exe",
"InitiatingProcessVersionInfoOriginalFileName": "taskhostw.exe",
"InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
"InitiatingProcessVersionInfoProductVersion": "10.0.20348.3451",
"IsInitiatingProcessRemoteSession": 0,
"IsInitiatingProcessRemoteSession@odata.type": "#SByte",
"LogonType": "Unknown",
"RemoteIP": "-",
"ReportId": 1057950,
"ReportId@odata.type": "#Int64",
"Timestamp": "2026-08-01T09:02:29.1243928Z"
}
Detection Patterns #
Stealth: Create Process with Token
Common Indicators #
Positive field/value combinations most frequently checked by detection rules attached to this catalog entry, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
user (kusto rule field) | ends_with | $ | 1 rule | kusto |
Detection Rules #
Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →Kusto #
If NTLM Relaying is done towards a Linux machine, this query won't detect that. The attacker must have access to a Linux device in that case though.