type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--9ce98c86-8d30-4043-ba54-0784d478d0b5
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0067
external_id: DC0067
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Logon Session Creation
description: The successful establishment of a new user session following a successful authentication attempt. This typically signifies that a user has provided valid credentials or authentication tokens, and the system has initiated a session associated with that user account. This data is crucial for tracking authentication events and identifying potential unauthorized access. Examples: 

- Windows Systems
 - Event ID: 4624
 - Logon Type: 2 (Interactive) or 10 (Remote Interactive via RDP).
 - Account Name: JohnDoe
 - Source Network Address: 192.168.1.100
 - Authentication Package: NTLM
- Linux Systems
 - /var/log/utmp or /var/log/wtmp:
 - Log format: login user [tty] from [source_ip]
 - User: jane
 - IP: 10.0.0.5
 - Timestamp: 2024-12-28 08:30:00
- macOS Systems
 - /var/log/asl.log or unified logging framework:
 - Log: com.apple.securityd: Authentication succeeded for user 'admin'
- Cloud Environments
 - Azure Sign-In Logs:
 - Activity: Sign-in successful
 - Client App: Browser
 - Location: Unknown (Country: X)
- Google Workspace
 - Activity: Login
 - Event Type: successful_login
 - Source IP: 203.0.113.55
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: Logon Session
channel: None
name: macos:unifiedlog
channel: UserLoggedIn
name: AWS:CloudTrail
channel: ConsoleLogin, AssumeRole, ListResources
name: azure:signin
channel: UserLoginSuccess, TokenIssued
name: Okta:SystemLog
channel: user.authentication.sso, app.oauth.grant
name: m365:signinlogs
channel: SignInSuccess, RoleAssignmentRead
name: m365:unified
channel: UserLoggedIn
name: gcp:audit
channel: LoginAudit, DriveAudit
name: saas:auth
channel: LoginSuccess, APIKeyUse, AdminAction
name: azure:signinlogs
channel: Abnormal sign-in from scripting tools (PowerShell, AADInternals)
name: azure:signinlogs
channel: Suspicious login to cloud mailbox system
name: azure:signinlogs
channel: Failed MFA attempts, unusual conditional access triggers, login attempts from unexpected IP ranges
name: AWS:CloudTrail
channel: ConsoleLogin
name: WinEventLog:Security
channel: EventCode=4624, 4648
name: NSM:Connections
channel: Mismatch between recorded user logon and active sessions (e.g., wtmp/utmp entries without corresponding authentication in auth.log)
name: macos:unifiedlog
channel: Authentication inconsistencies where commands are executed without corresponding login events
name: CloudTrail:Signin
channel: SAML login without corresponding IdP authentication log
name: m365:sharepoint
channel: File access with forged or anomalous SAML claims
name: AWS:CloudTrail
channel: Web console logins using session cookies without corresponding MFA event
name: saas:access
channel: Multiple concurrent logins using same cookie from different locations
name: AWS:CloudTrail
channel: ConsoleLogin: If IdP backed by cloud provider, Console login from new IP/agent after correlated endpoint compromise
name: macos:unifiedlog
channel: authentication
name: AWS:CloudTrail
channel: SendSSHPublicKey, StartSession (SSM), EC2InstanceConnect
name: azure:signin
channel: Microsoft.Compute/virtualMachines/serialConsole/connect/action
name: gcp:audit
channel: cloud.ssh.publicKey.inserted, compute.instances.osLogin
name: NSM:Connections
channel: Missing new login event but session activity continues
name: macos:unifiedlog
channel: Session reuse without new auth event
name: AWS:CloudTrail
channel: Temporary security credentials used to authenticate into management console or APIs
name: macos:unifiedlog
channel: Access to Keychain items or browser credential stores
name: m365:signinlogs
channel: Token usage events with device/user mismatch
name: saas:github
channel: Login from unusual IP, device fingerprint, or location; access token creation from new client
name: linux:syslog
channel: sshd: Accepted password/publickey
name: macos:unifiedlog
channel: eventMessage CONTAINS 'screensharingd' or 'AuthorizationRefCreate'
name: AWS:CloudTrail
channel: AWS ConsoleLogin, StartSession
name: esxi:vmkernel
channel: vim.fault.*, DCUI login, SSH shell
name: AWS:CloudTrail
channel: GetConsoleOutput
name: saas:okta
channel: user.session.start
name: m365:unified
channel: ViewAdminReport
name: saas:zoom
channel: Zoom Admin Dashboard accessed from unfamiliar IP/device
name: WinEventLog:Security
channel: Anomalous logon without MFA enforcement
name: networkdevice:Firewall
channel: Login from untrusted IP, or new admin account accessing firewall console/API
name: linux:syslog
channel: authentication success after file access
name: macos:unifiedlog
channel: Keychain or user login post-access
name: AWS:CloudTrail
channel: sudden role assumption after credential file access
name: NSM:Connections
channel: Accepted publickey for user from unusual IP or without tty
name: saas:confluence
channel: logon
name: linux:syslog
channel: auth.log / secure.log
name: esxi:auth
channel: Shell login or escalation
name: linux:auth
channel: User login event followed by unexpected process tree
name: azure:signinlogs
channel: InteractiveUserLogin: Discovery behavior linked to privileged logins from atypical IP ranges
name: m365:signinlogs
channel: UserLogin: Discovery operations shortly after account logins from new geolocations
name: saas:auth
channel: Login, TokenGranted: Discovery actions tied to anomalous login sessions or tokens
name: NSM:Connections
channel: simultaneous or anomalous logon sessions across multiple systems
name: macos:unifiedlog
channel: authentication plugin load or modification events
name: azure:ad
channel: SignInEvents
name: linux:syslog
channel: Accepted publickey/password for * from * port * ssh2
name: macos:unifiedlog
channel: loginwindow or sshd successful login events
name: azure:signinlogs
channel: InteractiveUser, ServicePrincipalSignIn
name: AWS:CloudTrail
channel: AssumeRole,AssumeRoleWithSAML,AssumeRoleWithWebIdentity
name: azure:signinlogs
channel: InteractiveUser, NonInteractiveUser
name: azure:signinlogs
channel: UserLogin, ConditionalAccessPolicyEvaluated
name: saas:okta
channel: session.token.reuse
name: auditd:SYSCALL
channel: capset or setns
name: gcp:audit
channel: admin.googleapis.com
name: m365:signinlogs
channel: UserLoggedIn
name: WinEventLog:Security
channel: EventCode=4624
name: linux:syslog
channel: None