Windows Event ID 4624 displays a numerical value for the type of login that was attempted. These numbers are important from a forensic standpoint but also for understanding credential exposure and mitigating risks. Descriptions in replies.
Logon type 10: this is a typical RDP alert meaning that terminal services was engaged for the logon. 3rd party software like virtualization consoles and screen share can also generate it. Means credentials were in memory (lsass) and also hit cached credentials.
Logon type 2: interactive logon, typically associated with hands on keyboard. Credentials in memory and cached credentials. This event can also be generated using RunAs - which is why some normal admin behavior is risky.
https://twitter.com/jepaynemsft/status/667060460466737152
Logon type 4: this says ‘batch’ but it usually means scheduled task. If you run a task with a domain admin credential it both gets into lsass memory and is stored in a portion of the registry accessible to all administrators known as LSAsecrets. Look for the logon to track risk.
Logon type 5: logon as a service. Just like batch these creds hit disk and memory. The LSAsecrets registry portion stores these credentials so services can start. Attackers (or users) with admin can recover them. Grill vendors that ask for services running as wide/domain admin.
Logon type 9: RunAs Netonly. I have written an entire blog post about complications this logon type can add to security threat models and investigations: blogs.technet.microsoft.com/jepayne/2016/0…
Logon type 3: ‘Network logon.’ This is a logon that means credentials don’t get stored in lsass or on disk - which makes it a safer remote admin options. There is still a risk of credential theft if Kerberos delegation is in play for the account or the endpoint in question.
Logon type 8: clear text logon. Means creds were sent over wire in plain text usually for IIS. Other circumstances such some powershell and 3rd party management software on same host can show it too. But it does mean plain text, exposure is on network-IPSec can mitigate.
Logon type 7: workstation unlock. It means what it says and leads to a logon type 2. However it should not be used as a reliable forensic artifact of a butt in a chair or at a RDP console as there are ways it doesn’t happen. Lack of a 7 does not mean there was no unlock.
Logon type 11: Cached Interactive. This is what makes laptops work from home so don’t disable it out of paranoia. Uses cached credentials to logon. Cached creds are stored in mscache2 format which contrary to popular belief can be cracked.Avoid high value account logins to these.
If you are overwhelmed by various Windows logon types and not sure how to track them in your environment, I wrote a tool that can help with that :
https://twitter.com/jepaynemsft/status/940235658919997446?s=21
• • •
Missing some Tweet in this thread? You can try to
force a refresh
