Windows: Administrator Account Remote Logon via Negotiate (4624 LogonType 10)

Alerts on remote logons to admin-named accounts in Windows Security logs (4624, LogonType 10, Negotiate).

FreeReviewedSigma · Low · v2

Product: windows
Service: security
Author: juju4 (SigmaHQ), DRL 1.1
Published: 2017-10-29
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Defense Evasion

What it detects

This rule identifies Windows security events where the Administrator account name matches an internal pattern (TargetUserName starting with "Admin") and the host records a successful remote interactive logon (EventID 4624, LogonType 10) using the Negotiate authentication package. Remote logons to privileged accounts are high-value because they can enable administrative access, persistence, or lateral movement. It relies on Windows Security Audit telemetry (4624) including TargetUserName, LogonType, and AuthenticationPackageName.

Reporting behind it

Related detections9 linkedT1078.002 — drag to rearrange

macOS Root Account Enable Attempt via dsenableroot

Suspicious Hidden Account Creation via Winlogon SpecialAccounts UserList Registry

Possible FortiWeb Authentication Bypass via Path Traversal to fwbcgi (via webserver)

Malicious Domain Admin Account Escalation via net group (via process_creation)

Possible Check Point Management Application Token Authentication as Administrator (via checkpoint)

Windows Process Creation: Commvault qlogin using _+_PublicSharingUser_ and GUID Password

PowerShell dMSA Service Account Creation in Target OUs via New-ADServiceAccount

Windows: New-ADServiceAccount Creates Delegated Service Account in Target OUs

Windows PowerShell Modifies dMSA msDS-ManagedAccountPrecededByLink Attributes

Windows: Administrator Account Remote Logon via Negotiate (4624 LogonType 10)

Pivot detection · T1078.002 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-admin-account-remote-logon-event-id-4624-logontype-10-0f63e1ef

title: "Windows: Administrator Account Remote Logon via Negotiate (4624 LogonType 10)"
id: 2705cdb1-bf2c-4821-b4ad-1b0d9bedf908
status: test
description: This rule identifies Windows security events where the Administrator account name matches an internal pattern (TargetUserName starting with "Admin") and the host records a successful remote interactive logon (EventID 4624, LogonType 10) using the Negotiate authentication package. Remote logons to privileged accounts are high-value because they can enable administrative access, persistence, or lateral movement. It relies on Windows Security Audit telemetry (4624) including TargetUserName, LogonType, and AuthenticationPackageName.
references:
  - https://car.mitre.org/wiki/CAR-2016-04-005
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_admin_rdp_login.yml
author: juju4, Huntrule Team
date: 2017-10-29
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.lateral-movement
  - attack.initial-access
  - attack.stealth
  - attack.t1078.001
  - attack.t1078.002
  - attack.t1078.003
  - car.2016-04-005
logsource:
  product: windows
  service: security
  definition: 'Requirements: Identifiable administrators usernames (pattern or special unique character. ex: "Admin-*"), internal policy mandating use only as secondary account'
detection:
  selection:
    EventID: 4624
    LogonType: 10
    AuthenticationPackageName: Negotiate
    TargetUserName|startswith: Admin
  condition: selection
falsepositives:
  - Legitimate administrative activity.
level: low
license: DRL-1.1
related:
  - id: 0f63e1ef-1eb9-4226-9d54-8927ca08520a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL