author: Zach Mathis
date: 2020/11/08
modified: 2021/11/26

title: Admin Logon
title_jp: 管理者ログオン
output: 'User: %SubjectUserName%  :  LogonID: %SubjectLogonId%'
output_jp: 'ユーザ: %SubjectUserName%  :  ログオンID: %SubjectLogonId%'
description: Prints logon information. 
description_jp: Prints logon information.

id: fdd0b325-8b89-469c-8b0c-e5ddfe39b62e
level: informational
status: stable
detection:
    selection:
        Channel: Security
        EventID: 4672
    filter:
        - SubjectUserName: "SYSTEM"
        - SubjectUserName: "LOCAL SERVICE"
        - SubjectUserName: "NETWORK SERVICE"
        - SubjectUserName|endswith: "$"
    condition: selection and not filter
falsepositives:
    - normal system usage
tags:
references:
sample-evtx: 
ruletype: hayabusa
