Windows Security Logon Event ID 4800: Workstation Lock After Inactivity

title: "Windows Security Logon Event ID 4800: Workstation Lock After Inactivity"
id: d886479a-9a3a-4e23-9dad-15154b4ad66e
status: stable
description: This rule identifies Windows Security events (Event ID 4800) indicating a workstation session was locked automatically after a period of inactivity. Locking sessions helps reduce risk of unauthorized access, but unexpected or frequent lock events can also be a sign of suspicious user activity or environmental changes. It relies on Windows Security log telemetry for EventID 4800 records.
references:
  - https://www.cisecurity.org/controls/cis-controls-list/
  - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
  - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4800
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_workstation_was_locked.yml
author: Alexandr Yampolskyi, SOC Prime, Huntrule Team
date: 2019-03-26
modified: 2023-12-11
tags:
  - attack.impact
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4800
  condition: selection
falsepositives:
  - Likely
level: informational
license: DRL-1.1
related:
  - id: 411742ad-89b0-49cb-a7b0-3971b5c1e0a4
    type: derived