SOC Event Lookup
Event ID 5828NetlogonP2

Windows Event ID 5828: Netlogon denied a vulnerable secure channel connection (trust)

Applicable version
Windows Server 2008 R2 and later
Last reviewed
2026-07-21

Quick summary

Netlogon Event ID 5828 records that a domain controller denied a vulnerable Netlogon secure channel connection using a trust account.

Technical Metadata

Technical metadata for Event ID 5828
Event ID5828
ProviderNETLOGON
ChannelSystem
LevelError
MITRE ATT&CKTA0008 Lateral Movement / T1210 Exploitation of Remote Services
Key fields to watchTrust Name, Trust Target, Client IP Address

Trigger Scenarios

Microsoft documents this event for CVE-2020-1472 Netlogon secure channel enforcement when a vulnerable trust-account connection is denied.

Key Fields

Trust Name

The trust account name associated with the denied vulnerable Netlogon secure channel connection.

Trust Target

The target trust relationship affected by the denied connection.

Client IP Address

The source IP address for the denied vulnerable trust-account connection and the first pivot for network containment.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 5828
SecurityEvent
| where EventID == 5828
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields described on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 5828
index=wineventlog source="WinEventLog:Security" EventCode=5828
| table _time, host, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and parsed field names vary by deployment. Apply the event-specific field conditions after validating local field extraction.
Cortex XQL: Retrieve Windows Security Event ID 5828
dataset = microsoft_windows_raw
| filter edr_event_id = 5828
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security or applicable Windows event channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 5828
title: Windows Security Event ID 5828
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5828
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented field conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID5828A vulnerable Netlogon secure-channel connection using a trust account was denied.Use EventID together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source
Account TypeTrust AccountDistinguishes an inter-domain trust connection from the machine-account condition in Event 5827.Use Account Type together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1210Exploitation of Remote Services

Detection Notes

Use threshold=1 denied vulnerable trust-account connection on a domain controller. Microsoft documents Event 5828 as a denied vulnerable Netlogon secure channel connection using a trust account and includes Trust Name, Trust Target, and Client IP Address; that condition is relevant to T1210 Exploitation of Remote Services because Zerologon abuses Netlogon secure channel behavior. Validate the Client IP Address against domain controller and trust partner inventories, then check for 5831 allow-list activity before treating it as legacy breakage.

Common False Positives

  • Unpatched trusted-domain infrastructure can trigger denials after enforcement without an active exploit attempt.
  • Legacy trusts and third-party domain controllers require remediation planning, but should not be silently suppressed.

Related Events

Sample Log

Sanitized event sample
EventID: 5828
Account Type: Trust Account
Trust Name: CHILD$
Trust Target: child.corp.example
Client IP Address: 10.10.20.15

Frequently Asked Questions

What does Windows Event ID 5828 mean?

A domain controller denied a vulnerable Netlogon secure-channel connection associated with a trust account.

Does Event ID 5828 always indicate malicious activity?

No. A legacy or unpatched trust partner can produce it without exploitation.

How should Event ID 5828 be investigated?

Validate Trust Name, Trust Target, client IP, both sides' patch state, and any corresponding 5831 allow-list event.

Sources