Windows Security 4634/4647 User Logoff Events

title: Windows Security 4634/4647 User Logoff Events
id: 8c26a36c-bba6-452a-b1a1-601c0bc8468d
status: test
description: This rule matches Windows Security audit events for user logoff, specifically Event ID 4634 and 4647. Logoff activity can help an investigation understand session termination timing and correlate user behavior across host activity, including potentially suspicious logon-to-logoff sequences. It relies on Windows Security log telemetry containing the corresponding event IDs.
references:
  - https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4634
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4647
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_user_logoff.yml
author: frack113, Huntrule Team
date: 2022-10-14
tags:
  - attack.impact
  - attack.t1531
logsource:
  service: security
  product: windows
detection:
  selection:
    EventID:
      - 4634
      - 4647
  condition: selection
falsepositives:
  - Unknown
level: informational
license: DRL-1.1
related:
  - id: 0badd08f-c6a3-4630-90d3-6875cca440be
    type: derived