Defender-DeviceLogonEvents

ActionType	Title	Sample	Rule
any	Logon activity	Y	Y
LogonSuccess	Logon succeeded	Y	Y
LogonFailed	Logon failed	Y	Y
LogonAttempted	Logon attempt outcome (derived)	Y	N

any: Logon activity

Table: DeviceLogonEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`ActionType`
`LogonType`	Logon type code (2=Interactive, 3=Network, 4=Batch, 5=Service, 7=Unlock, 8=NetworkCleartext, 9=NewCredentials, 10=RemoteInteractive, 11=CachedInteractive).
`AccountName`
`AccountDomain`
`AccountSid`
`RemoteIP`
`RemotePort`
`IsLocalAdmin`
`InitiatingProcessFileName`
`FailureReason`

Example Event #

{
  "AccountDomain": "ludus.domain",
  "AccountName": "jd-dc01-2022$",
  "ActionType": "LogonAttempted",
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "jd-dc01-2022$",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "taskhostw.exe SYSTEM",
  "InitiatingProcessCreationTime": "2026-08-01T09:02:28.5940585Z",
  "InitiatingProcessFileName": "taskhostw.exe",
  "InitiatingProcessFileSize": 113136,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\taskhostw.exe",
  "InitiatingProcessId": 9424,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "e890d9a2ddcbc873e135294daede01f4",
  "InitiatingProcessParentCreationTime": "2026-08-01T01:02:17.7717067Z",
  "InitiatingProcessParentFileName": "\\Device\\HarddiskVolume1\\Windows\\System32\\svchost.exe",
  "InitiatingProcessParentId": 2616,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "6ad8ce3f2b7a377c3ad27a45cf1659dbbecb470c",
  "InitiatingProcessSHA256": "45d8d8c878be23e1a41509ff0139dc3aa107956365f75b0f752e8b162357c2eb",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "7318349394480636",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host Process for Windows Tasks",
  "InitiatingProcessVersionInfoInternalFileName": "taskhostw.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "taskhostw.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.20348.3451",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LogonType": "Unknown",
  "RemoteIP": "-",
  "ReportId": 1057950,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T09:02:29.1243928Z"
}

Detection Patterns #

Defender-AlertEvidence any: Alert evidenceORDefender-AlertInfo any: Alert informationORDefender-DeviceLogonEvents any: Logon activity

1 rule

Kusto

Potential Ransomware activity related to Cobalt Strike (source)

Stealth: Create Process with Token

Defender-DeviceLogonEvents any: Logon activityORDefender-DeviceProcessEvents any: Process activity

1 rule

Kusto

Access Token Manipulation - Create Process with Token (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	eq	`ListeningConnectionCreated`	1 rule	kusto
`DestinationIp` (kusto rule field)	is_not_null		1 rule	kusto
`Protocol` (kusto rule field)	eq	`NTLM`	1 rule	kusto
`user` (kusto rule field)	ends_with	`$`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Password Spray source: Below queries detect password spray attacks using sliding window count plugin. Because of implementation of the sliding window, queries work better than the bin() usage, but may create duplicate alerts. Grouping can be used in such cases. Sentinel Query:
Potential NTLM Relay Attack to Domain Controller source: Below query detects NTLM authentication coming from Domain Controller machine accounts. This is not an expected behavior and it's an indication of NTLM relay attack.
If NTLM Relaying is done towards a Linux machine, this query won't detect that. The attacker must have access to a Linux device in that case though.
Detection Opportunities for Certighost (CVE-2026-54121) source

LogonSuccess: Logon succeeded

Table: DeviceLogonEvents

Fields #

Name	Description	Rules
`DeviceId`
`Timestamp`
`LogonType`	Logon type code (2=Interactive, 3=Network, 4=Batch, 5=Service, 7=Unlock, 8=NetworkCleartext, 9=NewCredentials, 10=RemoteInteractive, 11=CachedInteractive).	1 detection rule
`AccountName`
`AccountDomain`
`RemoteIP`		1 detection rule
`RemotePort`
`IsLocalAdmin`

Example Event #

{
  "AccountDomain": "ludus",
  "AccountName": "jd-win11-22h2-1$",
  "AccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1106",
  "ActionType": "LogonSuccess",
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "InitiatingProcessId": 0,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessParentId": 0,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "None",
  "InitiatingProcessUniqueId": "0",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LogonId": 98224038,
  "LogonId@odata.type": "#Int64",
  "LogonType": "Network",
  "Protocol": "Kerberos",
  "RemoteIP": "10.2.10.21",
  "RemoteIPType": "Private",
  "RemotePort": 50341,
  "ReportId": 1060925,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T09:30:44.2019888Z"
}

Detection Patterns #

Lateral Movement: Distributed Component Object Model

Defender-DeviceLogonEvents LogonSuccess: Logon succeededORDefender-IdentityInfo any: Identity information

1 rule

Kusto

Detect service account login on new device (source)

Robbe Van den Daele

Credential Access: Name Resolution Poisoning and SMB Relay

Defender-DeviceLogonEvents LogonSuccess: Logon succeededORDefender-DeviceNetworkEvents any: Network activityORConnectionSuccess: Connection succeededORConnectionAttempt: Connection attempt

1 rule

Kusto

NTLM Relay Attack (source)

FalconForce

Credential Access: Password Spraying

Defender-DeviceLogonEvents LogonSuccess: Logon succeededORLogonFailed: Logon failed

1 rule

Kusto

Password Spraying (source)

Lateral Movement: Remote Desktop Protocol

Defender-DeviceLogonEvents LogonSuccess: Logon succeededORDefender-DeviceProcessEvents any: Process activity

1 rule

Kusto

Remote Desktop Protocol - SharpRDP (source)

Lateral Movement: Exploitation of Remote Services

Defender-DeviceEvents PowerShellCommand: PowerShell command executedORDefender-DeviceLogonEvents LogonSuccess: Logon succeeded

1 rule

Kusto

Service Accounts Performing Remote PS (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ActionType` (kusto rule field)	eq	`LogonSuccess`	5 rules	kusto
`ActionType` (kusto rule field)	eq	`PowerShellCommand`	1 rule	kusto
`LogonType` (kusto rule field)	eq	`Network`	3 rules	kusto
`LogonType` (kusto rule field)	in	`RemoteInteractive`	1 rule	kusto
`LogonType` (kusto rule field)	in	`Unlock`	1 rule	kusto
`RemoteIPType` (kusto rule field)	ne	`Loopback`	3 rules	kusto
`Protocol` (kusto rule field)	eq	`NTLM`	2 rules	kusto
`RemoteDeviceName` (kusto rule field)	is_not_null		2 rules	kusto
`DestinationPort` (kusto rule field)	in	`445`	1 rule	kusto
`DestinationPort` (kusto rule field)	in	`80`	1 rule	kusto
`TargetDomainName` (kusto rule field)	in	`contoso`	1 rule	kusto
`TargetDomainName` (kusto rule field)	in	`contoso.local`	1 rule	kusto
`TargetDomainName` (kusto rule field)	in	`put your ad domains here!`	1 rule	kusto
`parent_process_name` (kusto rule field)	eq	`wsmprovhost.exe`	1 rule	kusto
`subnet` (kusto rule field)	is_null		1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Potentially Relayed NTLM Authentication - Microsoft Defender for Endpoint source: The below query detects NTLM logons where Network Address in the logon event doesn't match the Workstation Name's IP. This indicates potentially relayed NTLM authentication. It analyzes only the logons with domain accounts having admin privileges.

LogonFailed: Logon failed

Table: DeviceLogonEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`LogonType`	Logon type code (2=Interactive, 3=Network, 4=Batch, 5=Service, 7=Unlock, 8=NetworkCleartext, 9=NewCredentials, 10=RemoteInteractive, 11=CachedInteractive).
`AccountName`
`AccountDomain`
`RemoteIP`
`FailureReason`

Example Event #

{
  "AccountDomain": "jd-win11-22h2-1",
  "AccountName": "dwh_sec_u1",
  "ActionType": "LogonFailed",
  "AdditionalFields": {
    "IsLocalLogon": true
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "FailureReason": "InvalidUserNameOrPassword",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "domainadmin",
  "InitiatingProcessAccountObjectId": "11111111-1111-1111-1111-111111111111",
  "InitiatingProcessAccountSid": "S-1-5-21-1006758700-2167138679-1475694448-1105",
  "InitiatingProcessAccountUpn": "adminuser@example.onmicrosoft.com",
  "InitiatingProcessCommandLine": "wsmprovhost.exe -Embedding",
  "InitiatingProcessCreationTime": "2026-08-01T08:19:24.3062443Z",
  "InitiatingProcessFileName": "wsmprovhost.exe",
  "InitiatingProcessFileSize": 65536,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\wsmprovhost.exe",
  "InitiatingProcessId": 9640,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "High",
  "InitiatingProcessMD5": "378e99507c40ac1c4efa6d37a71ac706",
  "InitiatingProcessParentCreationTime": "2026-08-01T00:56:36.1647611Z",
  "InitiatingProcessParentFileName": "\\Device\\HarddiskVolume4\\Windows\\System32\\svchost.exe",
  "InitiatingProcessParentId": 1288,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "004164018d758153f077ae1d2c67218369e5847b",
  "InitiatingProcessSHA256": "d26f9ebb5c3fbae69495bb7f0fcc55652c2229092ed3d3b4c936c851524aae9a",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "9851624184873556",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host process for WinRM plug-ins",
  "InitiatingProcessVersionInfoInternalFileName": "wsmprovhost.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "wsmprovhost.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.22621.2506",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LogonType": "Network",
  "Protocol": "Negotiate",
  "ReportId": 5898,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T08:19:31.8545225Z"
}

Detection Patterns #

Credential Access: Password Spraying

Defender-DeviceLogonEvents LogonSuccess: Logon succeededORLogonFailed: Logon failed

1 rule

Kusto

Password Spraying (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`RemoteIPType` (kusto rule field)	ne	`Loopback`	1 rule	kusto

LogonAttempted: Logon attempt outcome (derived)

Table: DeviceLogonEvents

Fields #

Name	Description
`DeviceId`
`Timestamp`
`LogonType`	Logon type code (2=Interactive, 3=Network, 4=Batch, 5=Service, 7=Unlock, 8=NetworkCleartext, 9=NewCredentials, 10=RemoteInteractive, 11=CachedInteractive).
`AccountName`
`RemoteIP`

Example Event #

{
  "AccountDomain": "ludus.domain",
  "AccountName": "jd-dc01-2022$",
  "ActionType": "LogonAttempted",
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "InitiatingProcessAccountDomain": "ludus",
  "InitiatingProcessAccountName": "jd-dc01-2022$",
  "InitiatingProcessAccountSid": "S-1-5-18",
  "InitiatingProcessCommandLine": "taskhostw.exe SYSTEM",
  "InitiatingProcessCreationTime": "2026-08-01T09:02:28.5940585Z",
  "InitiatingProcessFileName": "taskhostw.exe",
  "InitiatingProcessFileSize": 113136,
  "InitiatingProcessFileSize@odata.type": "#Int64",
  "InitiatingProcessFolderPath": "c:\\windows\\system32\\taskhostw.exe",
  "InitiatingProcessId": 9424,
  "InitiatingProcessId@odata.type": "#Int64",
  "InitiatingProcessIntegrityLevel": "System",
  "InitiatingProcessMD5": "e890d9a2ddcbc873e135294daede01f4",
  "InitiatingProcessParentCreationTime": "2026-08-01T01:02:17.7717067Z",
  "InitiatingProcessParentFileName": "\\Device\\HarddiskVolume1\\Windows\\System32\\svchost.exe",
  "InitiatingProcessParentId": 2616,
  "InitiatingProcessParentId@odata.type": "#Int64",
  "InitiatingProcessSHA1": "6ad8ce3f2b7a377c3ad27a45cf1659dbbecb470c",
  "InitiatingProcessSHA256": "45d8d8c878be23e1a41509ff0139dc3aa107956365f75b0f752e8b162357c2eb",
  "InitiatingProcessSessionId": 0,
  "InitiatingProcessSessionId@odata.type": "#Int64",
  "InitiatingProcessTokenElevation": "TokenElevationTypeDefault",
  "InitiatingProcessUniqueId": "7318349394480636",
  "InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation",
  "InitiatingProcessVersionInfoFileDescription": "Host Process for Windows Tasks",
  "InitiatingProcessVersionInfoInternalFileName": "taskhostw.exe",
  "InitiatingProcessVersionInfoOriginalFileName": "taskhostw.exe",
  "InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System",
  "InitiatingProcessVersionInfoProductVersion": "10.0.20348.3451",
  "IsInitiatingProcessRemoteSession": 0,
  "IsInitiatingProcessRemoteSession@odata.type": "#SByte",
  "LogonType": "Unknown",
  "RemoteIP": "-",
  "ReportId": 1057950,
  "ReportId@odata.type": "#Int64",
  "Timestamp": "2026-08-01T09:02:29.1243928Z"
}

Defender-DeviceLogonEvents

any: Logon activity

Fields #

Example Event #

Detection Patterns #

Kusto

Stealth: Create Process with Token

Kusto

Common Indicators #

Detection Rules #

Kusto #

LogonSuccess: Logon succeeded

Fields #

Example Event #

Detection Patterns #

Lateral Movement: Distributed Component Object Model

Kusto

Credential Access: Name Resolution Poisoning and SMB Relay

Kusto

Credential Access: Password Spraying

Kusto

Lateral Movement: Remote Desktop Protocol

Kusto

Lateral Movement: Exploitation of Remote Services

Kusto

Common Indicators #

Detection Rules #

Kusto #

LogonFailed: Logon failed

Fields #

Example Event #

Detection Patterns #

Credential Access: Password Spraying

Kusto

Common Indicators #

LogonAttempted: Logon attempt outcome (derived)

Fields #

Example Event #

References #