Logon success
A successful Windows logon (Security 4624).
What it detects
A successful Windows logon (Security 4624). On its own this is routine and low-signal — it is surfaced so the correlation engine can pair it with a preceding failed-logon burst from the same source address and account, which together indicate a brute force that likely SUCCEEDED (account takeover). It is never an incident by itself.
MITRE ATT&CK mapping
- T1078Valid Accounts· Defense Evasion
False positives and triage
The overwhelming majority of successful logons are legitimate; this rule is deliberately low severity and low confidence. Treat a single success as context only — it becomes noteworthy when it directly follows a brute-force burst against the same account from the same source IP.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 10%. Source: rules/windows/logon_success.yaml, licensed under the Apache License 2.0.
id: windows.auth.logon_success
version: 1.1.0
status: stable
severity: low
confidence: 0.1
platforms: [windows]
role: context
mitre_techniques: [T1078]
description: |
A successful Windows logon (Security 4624). On its own this is routine and
low-signal — it is surfaced so the correlation engine can pair it with a
preceding failed-logon burst from the same source address and account, which
together indicate a brute force that likely SUCCEEDED (account takeover). It is
never an incident by itself.
match:
event_category: authentication
event_action: login_success
event_outcome: success
correlation_keys: [source_ip:user_name]
false_positive_guidance: |
The overwhelming majority of successful logons are legitimate; this rule is
deliberately low severity and low confidence. Treat a single success as context
only — it becomes noteworthy when it directly follows a brute-force burst
against the same account from the same source IP.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.