SOC Event Lookup
Event ID 4624LogonP1

Windows Event ID 4624: An account was successfully logged on

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4624 records a successful logon and provides the primary host-level record for determining who accessed a system, how they authenticated, and from where.

Technical Metadata

Technical metadata for Event ID 4624
Event ID4624
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0001 Initial Access / T1078 Valid Accounts
Key fields to watchNew Logon / Account Name, Logon Type, Network Information, Authentication Package / Logon Process

Trigger Scenarios

Windows generates this event when a logon session is created successfully. It covers local console access, network access, RDP, scheduled tasks, services, and other authentication mechanisms.

Key Fields

New Logon / Account Name

The account associated with the new session. Review the domain, account type, and whether the identity is expected on the target system.

Logon Type

Identifies the session type. Type 3 commonly represents SMB or other network access, Type 10 represents RDP, and Type 2 represents a local interactive session.

Network Information

Workstation Name, Source Network Address, and Source Port identify the client when the logon is remote. These values are useful for lateral-movement timelines.

Authentication Package / Logon Process

Shows the authentication path, such as Kerberos or NTLM. Unexpected NTLM use, unusual logon processes, or a mismatch with normal access patterns can be significant.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Event ID 4624
SecurityEvent
| where EventID == 4624
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Microsoft Sentinel Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Event ID 4624
index=wineventlog source="WinEventLog:Security" EventCode=4624
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before implementing event-specific filtering or aggregation.
Cortex XQL: Retrieve Event ID 4624
dataset = microsoft_windows_raw
| filter edr_event_id = 4624
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The relevant Windows event channel is ingested through a Cortex XDR Windows event collection path. Inspect raw provider fields because parsed field names vary by collection path and event provider.
Query reference
Sigma rule: Windows Event ID 4624
title: Windows Event ID 4624
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
LogonType3Network logon, such as access to a shared resource.It separates network authentication from local console and remote-interactive sessions. Source
LogonType10RemoteInteractive logon, commonly Remote Desktop or Terminal Services.It isolates successful remote-interactive sessions for RDP investigations. Source

MITRE ATT&CK Mapping

  • T1078Valid Accounts

Detection Notes

T1078 Valid Accounts triage should separate Logon Type 10 RemoteInteractive sessions from Type 3 network logons and compare the source with approved jump hosts and service paths. A Type 10 success immediately after 4625 failures, or a Type 3 session followed by ADMIN$ access in 5140, is more significant than an isolated successful logon; use Logon ID to bind the session to follow-on 4688 activity.

Common False Positives

  • Service accounts, scheduled tasks, and management platforms may create large volumes of expected logons.
  • Domain controllers and file servers commonly record Type 3 logons during normal application and SMB activity.
  • Jump hosts and remote-management tooling can produce legitimate Type 10 logons outside normal business hours.

Related Events

Sample Log

Sanitized event sample
Subject: Security ID: S-1-0-0
New Logon: Security ID: CORP\jsmith
Logon Type: 10
Workstation Name: WS-014
Source Network Address: 10.x.x.x
Authentication Package: Kerberos

Frequently Asked Questions

What does Windows Event ID 4624 mean?

Event ID 4624 records a successful Windows logon on the destination computer and identifies the account, logon type, authentication process, and available network origin.

Which 4624 logon type indicates RDP?

Logon Type 10 is RemoteInteractive and is commonly associated with Remote Desktop or Terminal Services.

Does Event ID 4624 prove valid-account abuse?

No. It records successful authentication, most of which is legitimate; abuse requires correlation with account expectations, source, logon type, preceding failures, and follow-on activity.

Sources