hard20 pts · first answer countsdetection-engineeringwindows-event-logscredential-access
Logon type 9 with seclogo
On a workstation you see 4624 with Logon Type 9, Logon Process "seclogo" and Authentication Package "Negotiate", started by a non-admin tool. What does this often indicate?
Discussion 0
Join free to post in the discussion.
Related questions
- What is Windows Event ID 4624?Cybersecurity Analyst
- False positive or false negative?Cybersecurity Analyst
- What is Sysmon Event ID 1?Cybersecurity Analyst
- What detection as code gives youCybersecurity Analyst
- The logsource block in a Sigma ruleCybersecurity Analyst
- Reading a selection and filter conditionCybersecurity Analyst
- What the contains modifier doesCybersecurity Analyst
- Why match Image with endswithCybersecurity Analyst