Windows: Administrator Account Remote Logon via Negotiate (4624 LogonType 10)

Alerts on remote logons to admin-named accounts in Windows Security logs (4624, LogonType 10, Negotiate).

FreeReviewedSigma · Low · v2

Product: windows
Service: security
Author: juju4 (SigmaHQ), DRL 1.1
Published: 2017-10-29
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Defense Evasion

What it detects

This rule identifies Windows security events where the Administrator account name matches an internal pattern (TargetUserName starting with "Admin") and the host records a successful remote interactive logon (EventID 4624, LogonType 10) using the Negotiate authentication package. Remote logons to privileged accounts are high-value because they can enable administrative access, persistence, or lateral movement. It relies on Windows Security Audit telemetry (4624) including TargetUserName, LogonType, and AuthenticationPackageName.

Reporting behind it

Related detections9 linkedT1078.001 — drag to rearrange

macOS Root Account Enable Attempt via dsenableroot

Suspicious Guest Account Privilege Escalation (via process_creation)

Suspicious New MFA Authenticator Registration via Azure AD (via azure)

Possible noPac sAMAccountName Spoofing via Machine Account Rename

Suspicious Local Administrator Account Addition via net localgroup

Malicious Masquerading Local Account WDAGUtilltyAccount Created via net user

Possible FortiWeb Path-Traversal Authentication Bypass Exploitation CVE-2025-64446

Suspicious Hidden Account Creation via Winlogon SpecialAccounts UserList Registry

Possible FortiWeb Authentication Bypass via Path Traversal to fwbcgi (via webserver)

Windows: Administrator Account Remote Logon via Negotiate (4624 LogonType 10)

Pivot detection · T1078.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-admin-account-remote-logon-event-id-4624-logontype-10-0f63e1ef

title: "Windows: Administrator Account Remote Logon via Negotiate (4624 LogonType 10)"
id: 2705cdb1-bf2c-4821-b4ad-1b0d9bedf908
status: test
description: This rule identifies Windows security events where the Administrator account name matches an internal pattern (TargetUserName starting with "Admin") and the host records a successful remote interactive logon (EventID 4624, LogonType 10) using the Negotiate authentication package. Remote logons to privileged accounts are high-value because they can enable administrative access, persistence, or lateral movement. It relies on Windows Security Audit telemetry (4624) including TargetUserName, LogonType, and AuthenticationPackageName.
references:
  - https://car.mitre.org/wiki/CAR-2016-04-005
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_admin_rdp_login.yml
author: juju4, Huntrule Team
date: 2017-10-29
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.lateral-movement
  - attack.initial-access
  - attack.stealth
  - attack.t1078.001
  - attack.t1078.002
  - attack.t1078.003
  - car.2016-04-005
logsource:
  product: windows
  service: security
  definition: 'Requirements: Identifiable administrators usernames (pattern or special unique character. ex: "Admin-*"), internal policy mandating use only as secondary account'
detection:
  selection:
    EventID: 4624
    LogonType: 10
    AuthenticationPackageName: Negotiate
    TargetUserName|startswith: Admin
  condition: selection
falsepositives:
  - Legitimate administrative activity.
level: low
license: DRL-1.1
related:
  - id: 0f63e1ef-1eb9-4226-9d54-8927ca08520a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL