Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1078-valid-accounts

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects successful network logons to Windows from non-private client IP addresses. A signal is raised when the source IP address is newly observed for the target user account after the learning period completes.

Strategy

This rule monitors Windows Security events where @evt.id is 4624 and @Event.EventData.Data.LogonType is 3 (network logon). LogonType 3 covers any network-based authentication including SMB file share access, named pipes, WMI, and scheduled task authentication. Events are limited to client addresses that are not classified as private internal networks. The detection tracks @network.client.ip for each @Event.EventData.Data.TargetUserName. After the learning period, a signal is raised for any network logon from a source IP the account has not previously used.

Triage and response

• Verify on {{host}} whether {{@Event.EventData.Data.TargetUserName}} is expected to authenticate over the network from external IPs and whether {{@network.client.ip}} matches a known ISP, VPN exit, or partner network for that user.
• Review recent sign-in history and account lifecycle changes (new hire, role change, break-glass use) that would explain a first-time source IP for that account.
• Examine adjacent security events on the same host around the logon time for failed attempts, privilege changes, or lateral movement indicators such as file share enumeration or service installations that would support follow-on activity.