Windows Security Logoff Events (Event ID 4634/4647)
Identifies Windows user logoff using Security Event IDs 4634 and 4647.
FreeReviewedSigma · Informational · v2
- Product
- windows
- Service
- security
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-10-14
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
Identifies Windows user logoff activity using Security log events with Event ID 4634 and 4647. Attackers may intentionally log off to end sessions, reduce activity visibility, or align with other actions during an investigation timeline. The rule relies on Windows Security audit telemetry that records user logoff-related event IDs.
Reporting behind it
- github.comhttps://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4634
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4647
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_user_logoff.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-security-4634-4647-user-logoff-events-0badd08f
title: Windows Security Logoff Events (Event ID 4634/4647)
id: 8c26a36c-bba6-452a-b1a1-601c0bc8468d
status: test
description: Identifies Windows user logoff activity using Security log events with Event ID 4634 and 4647. Attackers may intentionally log off to end sessions, reduce activity visibility, or align with other actions during an investigation timeline. The rule relies on Windows Security audit telemetry that records user logoff-related event IDs.
references:
- https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4634
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4647
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_user_logoff.yml
author: frack113, Huntrule Team
date: 2022-10-14
tags:
- attack.impact
- attack.t1531
logsource:
service: security
product: windows
detection:
selection:
EventID:
- 4634
- 4647
condition: selection
falsepositives:
- Unknown
level: informational
license: DRL-1.1
related:
- id: 0badd08f-c6a3-4630-90d3-6875cca440be
type: derived