0

Has anyone encountered this type of logon (4624 Type 3). The accounts are logging on then off within a few seconds. We are noticing this activity in the morning, which would be when they start working.

This particular person accessed my system, so this is an event log from my workstation. Usually the new logon fields are populated with host name and not user name.

Here you can see it is the username. There are no signs of the user logging into my computer, as in no new folder under user accounts, nothing in task manager, (since it's only a few seconds they login and out), no rdp sessions.

"An account was successfully logged on."

Subject:    
Security ID:      NULL SID    
Account Name:     -    
Account Domain:       -    
Logon ID:     0x0
Logon Information:    
Logon Type:       3    
Restricted Admin Mode:    -

Virtual Account:      No    
Elevated Token:       No
Impersonation Level: Impersonation    
New Logon:    
Security ID:      SS\\xxxxx (username changed)    
Account Name:     sxxxxx    
Account Domain:       DomainCOM    
Logon ID:     0x4625E0F1    
Linked Logon ID:      0x0    
Network Account Name: -    
Network Account Domain:   -    
Logon GUID:       {5e00ce54-bb64-abfd-ee11-ad64b9bc5c63}
Process Information:    
Process ID:       0x0    
Process Name:     -
Network Information:    
Workstation Name: -    
Source Network Address:   10.xxx.xxx.xx    
Source Port:      56543
Detailed Authentication Information:    
Logon Process:        Kerberos    
Authentication Package:   Kerberos
Transited Services:   -
Package Name (NTLM only): -
Key Length:       0

We just implemented a new SIEM solution and are getting lots of lateral movement with similar messages as these below. Should this be something we should worry about?

  • The event log entry itself doesn't really indicate anything interesting. Logon type 3 is network logon, meaning a remote user connected to your machine over a higher level protocol like SMB and authenticated as themselves using kerb. The potential risk of it is dependent on whatever the higher level protocol is, and what that protocol grants access on your machine. – Steve Dec 21 '19 at 19:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.