Windows Security 4611: Rubeus-Indicative New Trusted Logon Process Registration
Alerts on Windows Security Event 4611 registering a new trusted logon process named 'User32LogonProcesss'.
- Product
- windows
- Service
- security
- Author
- Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-10-24
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows Security events where a new trusted logon process is registered, specifically when the LogonProcessName matches 'User32LogonProcesss'. Attackers may leverage trusted logon process registration to enable credential access or lateral movement through established logon mechanisms. The detection relies on Windows Security auditing telemetry (Event ID 4611) with the registered logon process name.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security 4611: Rubeus-Indicative New Trusted Logon Process Registration"
id: 6fac1482-3f2d-4ffd-ba4f-c8619acf7e70
status: test
description: This rule flags Windows Security events where a new trusted logon process is registered, specifically when the LogonProcessName matches 'User32LogonProcesss'. Attackers may leverage trusted logon process registration to enable credential access or lateral movement through established logon mechanisms. The detection relies on Windows Security auditing telemetry (Event ID 4611) with the registered logon process name.
references:
- https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_register_new_logon_process_by_rubeus.yml
author: Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community, Huntrule Team
date: 2019-10-24
modified: 2022-10-09
tags:
- attack.lateral-movement
- attack.privilege-escalation
- attack.credential-access
- attack.t1558.003
logsource:
product: windows
service: security
detection:
selection:
EventID: 4611
LogonProcessName: User32LogonProcesss
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 12e6d621-194f-4f59-90cc-1959e21e69f7
type: derived