Logons

Last updated 10 Nov 2026

On this page

At a glance
What it reads
Signals it raises
How to read it
What it can't see
Try it yourself
Next

Logons answers: how was the host used, and from where?

At a glance

Question	How was the host used, and from where?
Reads	The Security log's logon records and the Remote Desktop logs.
Works best with	Logon auditing (success and failure) and Special Logon auditing.
Parameter	`Logons.max_rows`: the most rows of each table (default 10000).
Rule prefix	`LOGON`

What it reads

Source	Evidence
Security 4624 (logon), 4625 (failed logon), 4648 (explicit credentials), 4672 (administrative logon)	`logon`, `logon_failure`, `explicit_credentials`, `privileged_logon`
TerminalServices-LocalSessionManager 21-25, RemoteConnectionManager 1149, RdpCoreTS 131/140, Security 4778/4779	`rdp_session`
RDPClient 1024/1102 (connections made from this host)	`rdp_outbound`

Signal adds what Windows does not write: the logon type's name, the failure's reason in words, whether a source address is public or private, and what kind of account it is - all decided from the record's codes and SIDs.

Signals it raises

11 rules: 1 high, 8 medium, 2 low. The full text of each is in the rule catalog.

ID	Severity	Title	Evidence	ATT&CK
`LOGON-FROM-PUBLIC-IP`	high	A logon from an Internet address	`logon`, `rdp_session`	`T1133`, `T1021.001`, `T1078`
`LOGON-BRUTE-FORCE`	medium	Many failed logons for one account within an hour	run facts	`T1110.001`
`LOGON-LOCAL-ACCOUNT-OVER-NETWORK`	medium	A local account logged on from another computer	`logon`	`T1021.002`, `T1550.002`, `T1078.003`
`LOGON-NEW-CREDENTIALS`	medium	A logon with new credentials (runas /netonly, or pass-the-hash)	`logon`	`T1550.002`
`LOGON-PASSWORD-SPRAY`	medium	Failed logons for many accounts from one source within an hour	run facts	`T1110.003`
`LOGON-RDP-EXPOSED`	medium	Remote Desktop is reachable from the Internet	`rdp_session`	`T1133`, `T1021.001`
`LOGON-RDP-NO-SECURITY-LOGON`	medium	Remote Desktop sign-ins the Security log has no logon for	run facts	`T1685.005`, `T1021.001`
`LOGON-RDP-OUTBOUND-MANY`	medium	Remote Desktop connections from this host to many servers in one day	run facts	`T1021.001`
`LOGON-RDP-WITHOUT-NLA`	medium	Remote Desktop accepts connections without Network Level Authentication	run facts	`T1021.001`, `T1133`
`LOGON-DISABLED-ACCOUNT-ATTEMPT`	low	A logon was tried with a disabled account	`logon_failure`	`T1110`
`LOGON-FAILURES-FROM-PUBLIC-IP`	low	Failed logons from Internet addresses	`logon_failure`	`T1110`

How to read it

The tables: logons by account and type, failures and why, the source addresses and workstations, explicit credentials, administrative logons, Remote Desktop sessions in and out, and the daily trend. Look for a new source, a new account, a burst of failures.
Counted attacks (password guessing, spraying) are counted per minute; Signal reports the busiest 60 minutes, so an attack across an hour boundary is not split.
Public addresses stand out: a logon from a public address to a host that should be internal is worth an immediate look.

What it can't see

Try it yourself

Fail a logon

Lock your session and type a wrong password twice, then sign in.
Run Logons

signal live -m Logons -o .\
Find your failures

In the logon failures table: your account, type 2 or 7, and the reason in words.

Users: who used the host.

At a glance#

What it reads#

Signals it raises#

How to read it#

What it can't see#

Try it yourself#

Next#