Logon Session Creation

The successful establishment of a new user session following a successful authentication attempt. This typically signifies that a user has provided valid credentials or authentication tokens, and the system has initiated a session associated with that user account. This data is crucial for tracking authentication events and identifying potential unauthorized access. Examples:

• Windows Systems
  • Event ID: 4624
    • Logon Type: 2 (Interactive) or 10 (Remote Interactive via RDP).
    • Account Name: JohnDoe
    • Source Network Address: 192.168.1.100
    • Authentication Package: NTLM
• Linux Systems
  • /var/log/utmp or /var/log/wtmp:
    • Log format: login user [tty] from [source_ip]
    • User: jane
    • IP: 10.0.0.5
    • Timestamp: 2024-12-28 08:30:00
• macOS Systems
  • /var/log/asl.log or unified logging framework:
    • Log: com.apple.securityd: Authentication succeeded for user 'admin'
• Cloud Environments
  • Azure Sign-In Logs:
    • Activity: Sign-in successful
    • Client App: Browser
    • Location: Unknown (Country: X)
• Google Workspace
  • Activity: Login
    • Event Type: successful_login
    • Source IP: 203.0.113.55

This data component can be collected through the following measures:

• Windows Systems
  • Event Logs: Monitor Security Event Logs using Event ID 4624 for successful logons.
  • PowerShell Example: Get-EventLog -LogName Security -InstanceId 4624
• Linux Systems
  • Log Files: Monitor /var/log/utmp, /var/log/wtmp, or /var/log/auth.log for logon events.
  • Tools: Use last or who commands to parse login records.
• macOS Systems
  • Log Sources: Monitor /var/log/asl.log or Apple Unified Logs using the log show command.
  • Command Example: log show --predicate 'eventMessage contains "Authentication succeeded"' --info
• Cloud Environments
  • Azure AD: Use Azure Monitor to analyze sign-in logs. Example CLI Query: az monitor log-analytics query -w <workspace_id> --analytics-query "AzureActivity | where ActivityStatus == 'Success' and OperationName == 'Sign-in'"
  • Google Workspace: Enable and monitor Login Audit logs from the Admin Console.
  • Office 365: Use Audit Log Search in Microsoft 365 Security & Compliance Center for login-related events.
• Network Logs
  • Sources: Network authentication mechanisms (e.g., RADIUS or TACACS logs).
• Enable EDR Monitoring:
  • EDR tools monitor logon session activity, including the creation of new sessions.
  • Configure alerts for: Suspicious logon types (e.g., Logon Type 10 for RDP or Type 5 for Service). Logons from unusual locations, accounts, or devices.
  • Leverage EDR telemetry for session attributes like source IP, session duration, and originating process.