Windows: Administrator Account Remote Logon via Negotiate (4624 LogonType 10)
Alerts on remote logons to admin-named accounts in Windows Security logs (4624, LogonType 10, Negotiate).
- Product
- windows
- Service
- security
- Author
- juju4 (SigmaHQ), DRL 1.1
- Published
- 2017-10-29
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows security events where the Administrator account name matches an internal pattern (TargetUserName starting with "Admin") and the host records a successful remote interactive logon (EventID 4624, LogonType 10) using the Negotiate authentication package. Remote logons to privileged accounts are high-value because they can enable administrative access, persistence, or lateral movement. It relies on Windows Security Audit telemetry (4624) including TargetUserName, LogonType, and AuthenticationPackageName.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Administrator Account Remote Logon via Negotiate (4624 LogonType 10)"
id: 2705cdb1-bf2c-4821-b4ad-1b0d9bedf908
status: test
description: This rule identifies Windows security events where the Administrator account name matches an internal pattern (TargetUserName starting with "Admin") and the host records a successful remote interactive logon (EventID 4624, LogonType 10) using the Negotiate authentication package. Remote logons to privileged accounts are high-value because they can enable administrative access, persistence, or lateral movement. It relies on Windows Security Audit telemetry (4624) including TargetUserName, LogonType, and AuthenticationPackageName.
references:
- https://car.mitre.org/wiki/CAR-2016-04-005
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_admin_rdp_login.yml
author: juju4, Huntrule Team
date: 2017-10-29
modified: 2022-10-09
tags:
- attack.privilege-escalation
- attack.persistence
- attack.lateral-movement
- attack.initial-access
- attack.stealth
- attack.t1078.001
- attack.t1078.002
- attack.t1078.003
- car.2016-04-005
logsource:
product: windows
service: security
definition: 'Requirements: Identifiable administrators usernames (pattern or special unique character. ex: "Admin-*"), internal policy mandating use only as secondary account'
detection:
selection:
EventID: 4624
LogonType: 10
AuthenticationPackageName: Negotiate
TargetUserName|startswith: Admin
condition: selection
falsepositives:
- Legitimate administrative activity.
level: low
license: DRL-1.1
related:
- id: 0f63e1ef-1eb9-4226-9d54-8927ca08520a
type: derived