Windows Security 4624 LogonType 9 Impersonation via Negotiate (Advapi) Token Abuse Indicator

Identifies Windows successful logons consistent with potential access token impersonation using Advapi and Negotiate.

FreeReviewedSigma · Medium · v2

Product: windows
Service: security
Author: Michaela Adams, Zach Mathis (SigmaHQ), DRL 1.1
Published: 2022-11-06
Updated: 2026-07-31

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1134.001Token Impersonation/Theft
Defense Evasion
- T1134.001Token Impersonation/Theft
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows Security Event ID 4624 logons with LogonType 9 where the logon process is Advapi and the authentication package is Negotiate, indicating an impersonation-related authentication context. Attackers can abuse access tokens to impersonate other users and conduct stealthy activity under different credentials. The detection relies on Windows Security auditing telemetry for EventID, LogonType, LogonProcessName, AuthenticationPackageName, and ImpersonationLevel values.

Reporting behind it

Related detections9 linkedT1134.001 — drag to rearrange

Malicious Potato Family Privilege Escalation Tool Execution (via process_creation)

Masquerading Cobalt Strike GetSystem Named-Pipe Impersonation Pattern (via process_creation)

Malicious Named Pipe kesknq for Token Impersonation (via pipe_created)

SharpDPAPI Tool Execution via Command-Line and PE Metadata on Windows

Windows Security: Detect NoFilter Tool Activity via RonPolicy Filtering Policy Indicators

SharpImpersonation Tool Execution on Windows

Windows Process Creation: Impersonate.exe HackTool Execution

Windows: Detect Named Pipe Creation with Koh Default Names

Windows getsystem via Meterpreter/Cobalt Strike when services.exe starts a likely privilege escalation command

Windows Security 4624 LogonType 9 Impersonation via Negotiate (Advapi) Token Abuse Indicator

Pivot detection · T1134.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-potential-access-token-abuse-via-new-credentials-impersonation-02f7c9c1

title: Windows Security 4624 LogonType 9 Impersonation via Negotiate (Advapi) Token Abuse Indicator
id: f769fd7f-13f3-4436-b06b-addaa6b382a4
status: test
description: This rule flags Windows Security Event ID 4624 logons with LogonType 9 where the logon process is Advapi and the authentication package is Negotiate, indicating an impersonation-related authentication context. Attackers can abuse access tokens to impersonate other users and conduct stealthy activity under different credentials. The detection relies on Windows Security auditing telemetry for EventID, LogonType, LogonProcessName, AuthenticationPackageName, and ImpersonationLevel values.
references:
  - https://www.elastic.co/fr/blog/how-attackers-abuse-access-token-manipulation
  - https://www.manageengine.com/log-management/cyber-security/access-token-manipulation.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_access_token_abuse.yml
author: Michaela Adams, Zach Mathis, Huntrule Team
date: 2022-11-06
modified: 2023-04-26
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1134.001
  - stp.4u
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 9
    LogonProcessName: Advapi
    AuthenticationPackageName: Negotiate
    ImpersonationLevel: "%%1833"
  condition: selection
falsepositives:
  - Anti-Virus
level: medium
license: DRL-1.1
related:
  - id: 02f7c9c1-1ae8-4c6a-8add-04693807f92f
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL