Lesson 11 — Investigating DeviceLogonEvents

Learning objectives

After completing this lesson, you should be able to investigate endpoint authentication using Defender for Endpoint telemetry.

• Explain what DeviceLogonEvents records.
• Interpret logon types, account domains and authentication results.
• Identify the source device, source IP and account involved.
• Recognise suspicious RDP, service and lateral movement patterns.
• Correlate logon activity with process, network and timeline evidence.

The problem this solves

A successful logon does not automatically mean access was authorised.

DeviceLogonEvents helps analysts understand who authenticated, from where, using which logon type and what activity followed.

Why logon telemetry matters

Attackers often rely on stolen or reused credentials.

Logon telemetry can reveal unauthorised access, remote sessions, service abuse and movement between devices.

Timestamp

The timestamp shows when the logon attempt occurred.

Correlate it with process creation, network activity and alerts to place the authentication within the attack sequence.

DeviceName

DeviceName identifies the endpoint where the logon occurred.

Check whether the device is high value, risky or involved in related incidents.

AccountName

AccountName identifies the user or service account involved.

Determine whether the account is expected to access the device and whether it has elevated privileges.

AccountDomain

AccountDomain helps distinguish local, domain and system identities.

This is important when determining whether the authentication was local or part of broader domain activity.

ActionType

ActionType indicates whether the logon succeeded or failed and may identify related authentication activity.

Review repeated failures, unusual success patterns and sudden changes in behaviour.

Interactive logons

Interactive logons usually represent a user signing in at the console.

Check the time, account, device ownership and whether the user was expected to be present.

Remote Interactive logons

Remote Interactive activity commonly represents RDP or another remote session.

Review the source address, account privilege, device role and follow-on process activity.

Network logons

Network logons occur when an account accesses a resource across the network.

SMB and administrative activity can generate legitimate or suspicious network logons.

Batch logons

Batch logons are commonly associated with scheduled tasks.

Unexpected batch activity may indicate persistence or misuse of automation credentials.

Service logons

Service logons occur when Windows services run under an account.

New service-account use or service logons on unusual devices can indicate persistence or lateral movement.

Local accounts

Local accounts exist only on a specific device.

Unexpected local administrator use or the same local credentials appearing across devices may indicate credential reuse.

Domain accounts

Domain accounts can authenticate across multiple joined devices.

Review whether the account is expected on the target device and whether the source system is trusted.

SYSTEM

SYSTEM is a highly privileged local security context.

Unexpected authentication or process activity associated with SYSTEM may indicate service abuse or privilege escalation.

LOCAL SERVICE

LOCAL SERVICE is a built-in low-privilege service identity.

Use it as context when deciding whether service activity is normal.

NETWORK SERVICE

NETWORK SERVICE is a built-in identity used by services that access network resources.

Unexpected remote activity from this account may require investigation.

RemoteDeviceName

RemoteDeviceName may identify the source device associated with the logon.

Use it to determine whether the source is managed, expected and involved in other suspicious activity.

RemoteIP

RemoteIP identifies the network source of the authentication.

Determine whether it is internal, external, trusted or associated with unusual infrastructure.

Remote port context

Network and remote interactive logons may correlate with ports such as 445 or 3389.

Use DeviceNetworkEvents to confirm the communication path.

Successful logons

A successful logon confirms that authentication completed.

It does not prove the access was legitimate, especially if the account, source or time is unusual.

Failed logons

Failed attempts can indicate mistyped passwords, stale credentials, brute force or password spraying.

Look for repetition across accounts, devices or source addresses.

Repeated failures followed by success

A sequence of failures followed by success can indicate credential guessing or eventual use of a valid password.

Review the source, account, timing and subsequent activity.

Authentication packages

Authentication package information can help distinguish Kerberos, NTLM and other mechanisms.

Unexpected NTLM use or fallback may deserve closer review.

Kerberos

Kerberos is commonly used for domain authentication.

Correlate unusual service access, source devices and privilege use with identity telemetry.

NTLM

NTLM remains present in many environments and can be abused in credential relay or pass-the-hash scenarios.

Unexpected NTLM authentication between devices should be reviewed carefully.

Pass-the-Hash indicators

Pass-the-Hash uses captured password hashes rather than plaintext passwords.

Look for unusual NTLM logons, lateral movement patterns and suspicious process activity on source and target devices.

InitiatingProcessFileName

Some logon events include initiating process context.

This can reveal which process triggered authentication or remote access.

InitiatingProcessCommandLine

The initiating command line can expose tools, scripts or remote administration commands.

Review it with the logon type and destination device.

Administrative tools

PsExec, PowerShell remoting, WMI, RDP and management tools can produce legitimate or malicious logon activity.

Validate the account, change record, source device and timing.

Service account misuse

Service accounts often have broad access and weak operational visibility.

Unexpected interactive or remote use of a service account may indicate compromise.

Privileged account use

Privileged accounts should have limited and well-understood access patterns.

Logons from unusual devices, times or sources should be investigated quickly.

Dormant accounts

Accounts that have not been used recently may be attractive to attackers.

Unexpected activity from dormant or disabled identities should trigger immediate review.

Pivot to DeviceProcessEvents

Check what executed after the logon.

Review command lines, parent processes, users and child processes associated with the session.

Pivot to DeviceNetworkEvents

Confirm source and destination communication.

Use ports, processes and timestamps to reconstruct the remote access path.

Pivot to IdentityLogonEvents

IdentityLogonEvents can provide broader identity and authentication context.

Use it to investigate the same account across devices and services.

Pivot to the Device Timeline

The timeline shows logons alongside process, file, registry and network activity.

Use it to understand what occurred before and after access was established.

Search across devices

Use account names, source IPs, remote device names and logon types to search for similar activity.

This helps determine whether the event is isolated or part of a broader campaign.

Baseline expected activity

Administrative tools, service accounts and management systems may generate normal logon events.

Understand expected access patterns to reduce false positives.

Common mistake

A common mistake is treating every failed logon as malicious.

Normal password mistakes, stale services and misconfiguration can also create failures.

Another common mistake

Do not assume a successful logon is authorised.

The account, source, logon type and follow-on activity determine whether access was legitimate.

Best practices

• Review the account and domain.
• Identify the logon type and result.
• Check the source device and IP address.
• Correlate follow-on process activity.
• Review privileged and service-account use.
• Search for the same pattern across devices.

Agent Foskett takeaway

Logon telemetry explains who accessed an endpoint, how they connected and what account was used.

DeviceLogonEvents helps analysts identify unauthorised access, RDP activity, service-account misuse and lateral movement by connecting authentication with device and identity evidence.