Windows Security 4624 LogonType 9 Using New Credentials

Flags Windows 4624 LogonType 9 events where new credentials are used for authentication.

FreeUnreviewedSigmalowv1

windows-security-4624-logontype-9-using-new-credentials-def8b624

title: Windows Security 4624 LogonType 9 Using New Credentials
id: 0302188c-0a19-4bfc-abae-53217ad600d8
status: test
description: This rule matches Windows Security logon events (EventID 4624) where the LogonType is 9, indicating a logon request that uses new credentials. Attackers may leverage this behavior during lateral movement or remote access to authenticate with freshly provided account material. It relies on Windows Security auditing telemetry, specifically EventID 4624 and the LogonType field.
references:
  - https://go.recordedfuture.com/hubfs/reports/mtp-2021-0914.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_susp_logon_newcredentials.yml
author: Max Altgelt (Nextron Systems), Huntrule Team
date: 2022-04-06
tags:
  - attack.lateral-movement
  - attack.t1550
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 9
  condition: selection
falsepositives:
  - Legitimate remote administration activity
level: low
license: DRL-1.1
related:
  - id: def8b624-e08f-4ae1-8612-1ba21190da6b
    type: derived

What it detects

This rule matches Windows Security logon events (EventID 4624) where the LogonType is 9, indicating a logon request that uses new credentials. Attackers may leverage this behavior during lateral movement or remote access to authenticate with freshly provided account material. It relies on Windows Security auditing telemetry, specifically EventID 4624 and the LogonType field.

Known false positives

Legitimate remote administration activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.