Logon Session Creation (9ce98c86-8d30-4043-ba54-0784d478d0b5)
The successful establishment of a new user session following a successful authentication attempt. This typically signifies that a user has provided valid credentials or authentication tokens, and the system has initiated a session associated with that user account. This data is crucial for tracking authentication events and identifying potential unauthorized access. Examples:
- Windows Systems
- Event ID: 4624
- Logon Type: 2 (Interactive) or 10 (Remote Interactive via RDP).
- Account Name: JohnDoe
- Source Network Address: 192.168.1.100
- Authentication Package: NTLM
- Event ID: 4624
- Linux Systems
- /var/log/utmp or /var/log/wtmp:
- Log format: login user [tty] from [source_ip]
- User: jane
- IP: 10.0.0.5
- Timestamp: 2024-12-28 08:30:00
- /var/log/utmp or /var/log/wtmp:
- macOS Systems
- /var/log/asl.log or unified logging framework:
- Log: com.apple.securityd: Authentication succeeded for user 'admin'
- /var/log/asl.log or unified logging framework:
- Cloud Environments
- Azure Sign-In Logs:
- Activity: Sign-in successful
- Client App: Browser
- Location: Unknown (Country: X)
- Azure Sign-In Logs:
- Google Workspace
- Activity: Login
- Event Type: successful_login
- Source IP: 203.0.113.55
- Activity: Login
This data component can be collected through the following measures:
- Windows Systems
- Event Logs: Monitor Security Event Logs using Event ID 4624 for successful logons.
- PowerShell Example:
Get-EventLog -LogName Security -InstanceId 4624
- Linux Systems
- Log Files: Monitor
/var/log/utmp,/var/log/wtmp, or/var/log/auth.logfor logon events. - Tools: Use
lastorwhocommands to parse login records.
- Log Files: Monitor
- macOS Systems
- Log Sources: Monitor
/var/log/asl.logor Apple Unified Logs using thelog showcommand. - Command Example:
log show --predicate 'eventMessage contains "Authentication succeeded"' --info
- Log Sources: Monitor
- Cloud Environments
- Azure AD: Use Azure Monitor to analyze sign-in logs. Example CLI Query:
az monitor log-analytics query -w <workspace_id> --analytics-query "AzureActivity | where ActivityStatus == 'Success' and OperationName == 'Sign-in'" - Google Workspace: Enable and monitor Login Audit logs from the Admin Console.
- Office 365: Use Audit Log Search in Microsoft 365 Security & Compliance Center for login-related events.
- Azure AD: Use Azure Monitor to analyze sign-in logs. Example CLI Query:
- Network Logs
- Sources: Network authentication mechanisms (e.g., RADIUS or TACACS logs).
- Enable EDR Monitoring:
- EDR tools monitor logon session activity, including the creation of new sessions.
- Configure alerts for: Suspicious logon types (e.g., Logon Type 10 for RDP or Type 5 for Service). Logons from unusual locations, accounts, or devices.
- Leverage EDR telemetry for session attributes like source IP, session duration, and originating process.