SOC Event Lookup
Event ID 4611LSAP3

Windows Event ID 4611: A trusted logon process has been registered with the LSA

Applicable version
Windows Server 2008 and later; Windows Vista and later
Last reviewed
2026-07-22

Quick summary

Windows Security Event ID 4611 records that a logon process has been confirmed as trusted by the Local Security Authority and can submit logon requests.

Technical Metadata

Technical metadata for Event ID 4611
Event ID4611
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
MITRE ATT&CKTA0006 Credential Access / T1556 Modify Authentication Process
Key fields to watchSubject\Security ID, Logon Process Name, Subject\Logon ID

Trigger Scenarios

The event typically appears during operating-system startup or authentication activity when trusted logon processes register with LSA.

Key Fields

Subject\Security ID

Microsoft recommends reporting this event when the subject is not SYSTEM. SYSTEM registrations commonly appear with Logon ID 0x3e7; any user or service SID outside that baseline requires review.

Logon Process Name

The registered logon process name. Microsoft examples include Winlogon; an unapproved value means LSA will accept logon requests from a new source.

Subject\Logon ID

Hexadecimal correlation value. Use 0x3e7 as the common SYSTEM logon session baseline, and pivot to 4624 events with the same value if the registering account is unexpected.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 4611
SecurityEvent
| where EventID == 4611
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields documented on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 4611
index=wineventlog source="WinEventLog:Security" EventCode=4611
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source and field aliases vary by deployment. Apply event-specific field conditions after validating local extraction.
Cortex XQL: Retrieve Windows Security Event ID 4611
dataset = microsoft_windows_raw
| filter edr_event_id = 4611
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The applicable Windows event channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4611
title: Windows Security Event ID 4611
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4611
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
SubjectLogonId0x3e7The SYSTEM logon session used as the expected baseline in Microsoft monitoring guidance.Interpret SubjectLogonId with the complete event and correlated activity; this value alone is not proof of compromise. Source
LogonProcessNameWinlogonA known Windows logon process name used for allowlist comparison.Interpret LogonProcessName with the complete event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1556Modify Authentication Process

Detection Notes

Microsoft recommends reporting 4611 when Subject\Security ID is not SYSTEM; use the SYSTEM Logon ID 0x3e7 and known Logon Process Name values such as Winlogon as the baseline. A non-SYSTEM subject registering a new logon process is a T1556 signal because LSA will accept authentication requests from that process, so correlate by Subject\Logon ID to 4624 and by host to recent 4610 or 4614 package loads.

Common False Positives

  • Normal boot and interactive logon activity registers expected trusted logon processes.
  • Endpoint security, credential provider, or remote-access products may register approved logon components.

Related Events

Sample Log

Sanitized event sample
Subject:
  Security ID: CORP\svc-auth
  Account Name: svc-auth
  Logon ID: 0x45ab1
Logon Process Name: CustomAuth

Frequently Asked Questions

What does Windows Event ID 4611 mean?

A trusted logon process registered with the Local Security Authority.

Does Event ID 4611 always indicate malicious activity?

No. Standard Windows logon processes register during startup.

How should Event ID 4611 be investigated?

Escalate unknown process names or non-SYSTEM subjects and correlate SubjectLogonId with logon and package-load events.

Sources