Windows Security: DiagTrackEoP POC Default UserName Login Attempt (LogonType 9)
Alerts on Windows 4624 LogonType 9 events targeting a known DiagTrackEoP default username.
FreeReviewedSigma · Critical · v2
- Product
- windows
- Service
- security
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-03
- Updated
- 2026-07-31
What it detects
This rule flags Windows Security events (EventID 4624) with LogonType 9 where the TargetOutboundUserName matches the specific placeholder value used by the DiagTrackEoP proof-of-concept. Attackers may use this non-real default username during exploitation attempts, making it a high-signal indicator of suspicious authentication activity. It relies on Security log telemetry capturing successful logon events and the TargetOutboundUserName field.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-security-diagtrackeop-default-logon-username-eventid-4624-logontype-9-2111118f
title: "Windows Security: DiagTrackEoP POC Default UserName Login Attempt (LogonType 9)"
id: 9c8d8ef4-d922-442b-b6eb-dc4a1d8b4824
status: test
description: This rule flags Windows Security events (EventID 4624) with LogonType 9 where the TargetOutboundUserName matches the specific placeholder value used by the DiagTrackEoP proof-of-concept. Attackers may use this non-real default username during exploitation attempts, making it a high-signal indicator of suspicious authentication activity. It relies on Security log telemetry capturing successful logon events and the TargetOutboundUserName field.
references:
- https://github.com/Wh04m1001/DiagTrackEoP/blob/3a2fc99c9700623eb7dc7d4b5f314fd9ce5ef51f/main.cpp#L46
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_diagtrack_eop_default_login_username.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-03
tags:
- attack.privilege-escalation
logsource:
product: windows
service: security
detection:
selection:
EventID: 4624
LogonType: 9
TargetOutboundUserName: thisisnotvaliduser
condition: selection
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: 2111118f-7e46-4fc8-974a-59fd8ec95196
type: derived