deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-18 20:03:40 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Update event-4624.md

Browse Source 
Acro edit.
This commit is contained in:
Stephanie Savell
2023-03-08 13:51:11 -06:00
committed by GitHub
parent a3a015515a
commit e986e39327
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
windows/security/threat-protection/auditing/event-4624.md
View File

@ -318,6 +318,6 @@ For 4624(S): An account was successfully logged on.
- If the **Authentication Package** is NTLM. In this case, monitor for **Key Length** not equal to 128, because all Windows operating systems starting with Windows 2000 support 128-bit Key Length.
- If you monitor for potentially malicious software, or software that is not authorized to request logon actions, monitor this event for **Process Name**.
- If you monitor for potentially malicious software, or software that isn't authorized to request logon actions, monitor this event for **Process Name**.
- If you have a trusted logon processes list, monitor for a **Logon Process** that is not from the list.
- If you have a trusted logon processes list, monitor for a **Logon Process** that isn't from the list.