Windows Security: Outgoing Logon (LogonType 9) Using New Credentials (4624)

ATT&CK techniques

Defense Evasion → Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1550Use Alternate Authentication Material
Cred Access
Discovery
Lateral Movement
- T1550Use Alternate Authentication Material
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows Security logon events (EventID 4624) with LogonType 9, indicating an outgoing logon that uses new credentials. Such activity matters because attackers and administrators can leverage credential-based access to move laterally or access remote resources. The detection relies on Windows Security audit telemetry capturing the logon event details, specifically the event ID and logon type fields.

Reporting behind it

Related detections4 linkedT1550 — drag to rearrange

Suspicious High-Privilege Microsoft Graph Application Role Grant via Azure Audit (via azure)

AWS CloudTrail Alert for Suspicious SAML Role Assumption and SAML Provider Updates

AWS CloudTrail: Suspicious STS AssumeRole sessions from Role-issued principals

AWS CloudTrail: IAMUser STS GetSessionToken Use

Windows Security: Outgoing Logon (LogonType 9) Using New Credentials (4624)

Pivot detection · T1550 · 4 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-4624-logontype-9-using-new-credentials-def8b624

title: "Windows Security: Outgoing Logon (LogonType 9) Using New Credentials (4624)"
id: 0302188c-0a19-4bfc-abae-53217ad600d8
status: test
description: This rule flags Windows Security logon events (EventID 4624) with LogonType 9, indicating an outgoing logon that uses new credentials. Such activity matters because attackers and administrators can leverage credential-based access to move laterally or access remote resources. The detection relies on Windows Security audit telemetry capturing the logon event details, specifically the event ID and logon type fields.
references:
  - https://go.recordedfuture.com/hubfs/reports/mtp-2021-0914.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_susp_logon_newcredentials.yml
author: Max Altgelt (Nextron Systems), Huntrule Team
date: 2022-04-06
tags:
  - attack.lateral-movement
  - attack.t1550
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 9
  condition: selection
falsepositives:
  - Legitimate remote administration activity
level: low
license: DRL-1.1
related:
  - id: def8b624-e08f-4ae1-8612-1ba21190da6b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL