detection.wiki

Defender-IdentityLogonEvents

ActionTypeTitleSampleRule
anyIdentity logon activityYY
LogonSuccessIdentity logon succeededYY
LogonFailedIdentity logon failedYN

any: Identity logon activity

#
Table
IdentityLogonEvents

Example Event #

{
  "AccountDisplayName": "Admin User",
  "AccountDomain": "example.onmicrosoft.com",
  "AccountName": "adminuser",
  "AccountObjectId": "11111111-1111-1111-1111-111111111111",
  "AccountUpn": "adminuser@example.onmicrosoft.com",
  "ActionType": "LogonSuccess",
  "AdditionalFields": {
    "@odata.type": "#microsoft.graph.security.dynamicColumnValue",
    "Pass-through authentication": "false",
    "Request ID": "51e7884e-8af0-4749-9d00-e6ac3e500500"
  },
  "Application": "Microsoft 365",
  "DeviceType": "Desktop",
  "IPAddress": "203.0.113.10",
  "ISP": "comcast cable communications  llc",
  "LastSeenForUser": {
    "@odata.type": "#microsoft.graph.security.dynamicColumnValue",
    "ActionType": -1,
    "ActionType@odata.type": "#Int64",
    "Application": 2,
    "Application@odata.type": "#Int64",
    "CountryCode": 0,
    "CountryCode@odata.type": "#Int64",
    "IPAddress": 2,
    "IPAddress@odata.type": "#Int64",
    "ISP": 2,
    "ISP@odata.type": "#Int64",
    "OSPlatform": 0,
    "OSPlatform@odata.type": "#Int64",
    "UserAgent": 0,
    "UserAgent@odata.type": "#Int64"
  },
  "Location": "US",
  "LogonType": "Consent:Set",
  "OSPlatform": "OS X",
  "ReportId": "53dfec95ca1a45178035ebb1f2790df9ddb143f65a4c941a6197f6e85326f159",
  "Timestamp": "2026-08-01T16:29:39.595Z",
  "UncommonForUser": [
    "ActionType"
  ],
  "UncommonForUser@odata.type": "#Collection(String)"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
Image (kusto rule field)eqactive directory2 ruleskusto
Protocol (kusto rule field)eqKerberos2 ruleskusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

  • Suspicious SPN logon from workstation (DumpGuard) source: With the DumpGuard tool, attackers are able to dump credetials via Remote Credential Guard on devices that have Credential Guard enabled. Since the DumpGuard tool needs to use an SPN enabled account (in the POC they use a machine account) for two exploitation scenario's, it is interesting to look for TGT requests happening from client devices for SPN enabled accounts.T1003, T1003.004
  • Hunt domains with Seamless SSO enabled in Entra ID Connect source: With below KQL query you can search through the IdentityLogon events of Microsoft Defender for Identity to find users and devices still using Seamless SSO in Entra ID Connect. This feature has been marked by the community multiple times as a security risk, and should be disabled if not in use. The KQL query returns the domains where Seamless SSO is enabled, allong with the related users and devices. On top of that, devices get enriched to find their OS distribution, version, and join type and tells you if Seamless SSO is expected to be used for the related device or not. If there are no results or if all results are showing 'No' for the 'Seamless SSO Expected' column, it should be save to disable the feature in Entra ID connect. !Important: This query relies on the Domain Controller EventID 4769 and Defender for Identity. Make sure the EventID is being logged and Defender for Identity is healthy. For more information see references!

LogonSuccess: Identity logon succeeded

#
Table
IdentityLogonEvents

Example Event #

{
  "AccountDisplayName": "Admin User",
  "AccountDomain": "example.onmicrosoft.com",
  "AccountName": "adminuser",
  "AccountObjectId": "11111111-1111-1111-1111-111111111111",
  "AccountUpn": "adminuser@example.onmicrosoft.com",
  "ActionType": "LogonSuccess",
  "AdditionalFields": {
    "@odata.type": "#microsoft.graph.security.dynamicColumnValue",
    "Pass-through authentication": "false",
    "Request ID": "51e7884e-8af0-4749-9d00-e6ac3e500500"
  },
  "Application": "Microsoft 365",
  "DeviceType": "Desktop",
  "IPAddress": "203.0.113.10",
  "ISP": "comcast cable communications  llc",
  "LastSeenForUser": {
    "@odata.type": "#microsoft.graph.security.dynamicColumnValue",
    "ActionType": -1,
    "ActionType@odata.type": "#Int64",
    "Application": 2,
    "Application@odata.type": "#Int64",
    "CountryCode": 0,
    "CountryCode@odata.type": "#Int64",
    "IPAddress": 2,
    "IPAddress@odata.type": "#Int64",
    "ISP": 2,
    "ISP@odata.type": "#Int64",
    "OSPlatform": 0,
    "OSPlatform@odata.type": "#Int64",
    "UserAgent": 0,
    "UserAgent@odata.type": "#Int64"
  },
  "Location": "US",
  "LogonType": "Consent:Set",
  "OSPlatform": "OS X",
  "ReportId": "53dfec95ca1a45178035ebb1f2790df9ddb143f65a4c941a6197f6e85326f159",
  "Timestamp": "2026-08-01T16:29:39.595Z",
  "UncommonForUser": [
    "ActionType"
  ],
  "UncommonForUser@odata.type": "#Collection(String)"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
ActionType (kusto rule field)eqLogonSuccess1 rulekusto
Protocol (kusto rule field)eqKerberos1 rulekusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

LogonFailed: Identity logon failed

#
Table
IdentityLogonEvents

Example Event #

{
  "AccountDisplayName": "Admin User",
  "AccountDomain": "example.onmicrosoft.com",
  "AccountName": "adminuser",
  "AccountObjectId": "11111111-1111-1111-1111-111111111111",
  "AccountUpn": "adminuser@example.onmicrosoft.com",
  "ActionType": "LogonFailed",
  "AdditionalFields": {
    "@odata.type": "#microsoft.graph.security.dynamicColumnValue",
    "Pass-through authentication": "false",
    "Request ID": "51e7884e-8af0-4749-9d00-e6ac07500500"
  },
  "Application": "Microsoft 365",
  "DeviceType": "Desktop",
  "FailureReason": "The user or administrator has not consented to use the application. Send an interactive authorization request for this user and resource.",
  "IPAddress": "203.0.113.10",
  "ISP": "comcast cable communications  llc",
  "LastSeenForUser": {
    "@odata.type": "#microsoft.graph.security.dynamicColumnValue"
  },
  "Location": "US",
  "LogonType": "Login:reprocess",
  "OSPlatform": "OS X",
  "ReportId": "6e9b28e5ecf5a93be2031b2b58613fdaf29f08c47c0eafa8954e4cb6fb335d3f",
  "Timestamp": "2026-08-01T16:29:35.813Z",
  "UncommonForUser@odata.type": "#Collection(String)"
}

References #