event_simpleName=UserLogon Falcon sensor event

UserLogon: CrowdStrike Falcon Logon Event, LogonType and Queries

Published

One successful sign-in on a host — who logged on, how (LogonType), from which address for remote logons, whether the account is an administrator, and when its password was last set.

Fields that matter in an investigation

FieldWhat it tells you
1UserName Panther FDR schema · CrowdStrike queries The account that logged on. Machine accounts end in $; a CrowdStrike logon query leaves them out with UserName!=/\w+\$$/.
UserSid Panther FDR schema · CrowdStrike queries SID of the account (Windows). S-1-5-18 is SYSTEM; people's domain and local accounts start with S-1-5-21.
3LogonType Panther FDR schema · CrowdStrike queries How the logon happened, as a number — 2 interactive, 3 network, 4 batch, 5 service, 7 unlock, 10 remote interactive (RDP), 11 cached interactive.
RemoteAddressIP4 CrowdStrike queries For network and remote desktop logons, the address the logon came from. A public address on a type 10 logon is remote desktop reachable from the internet.
ClientComputerName CrowdStrike queries The client computer's name, when the logon carries one — CrowdStrike's examples read it on interactive and remote desktop logons.
UserIsAdmin Panther FDR schema · CrowdStrike queries 1 if the account has administrator rights on the host, 0 if not.
LogonTime Panther FDR schema When the logon happened, in Unix epoch seconds. CrowdStrike's queries multiply it by 1000 before formatting it.
PasswordLastSet Panther FDR schema · CrowdStrike queries When the account's password was last changed, in epoch seconds. CrowdStrike's logon dashboard turns it into a password age in days.
9LogonDomain CrowdStrike queries The domain of the account, or the computer name for a local account.
LogonServer CrowdStrike queries The server that authenticated the logon, usually a domain controller.
UserLogonFlags Panther FDR schema Bit flags — 0x2 user is an administrator, 0x4 user is local, 0x8 built-in account, 0x1 synthetic logon, 0x10 identity missing, per Panther's schema.
AuthenticationId Panther FDR schema The Windows logon session ID. Processes started in the session carry the same value in ProcessRollup2's AuthenticationId; 999 is SYSTEM.
13ComputerName Panther FDR schema · CrowdStrike queries The host that was logged on to.
All 19 documented UserLogon fields, besides the generic sensor fields
  • AuthenticationIdPanther FDR schema
  • ClientComputerNameCrowdStrike queries
  • EffectiveTransmissionClassPanther FDR schema
  • LogoffTimePanther FDR schema
  • LogonDomainCrowdStrike queries
  • LogonServerCrowdStrike queries
  • LogonTimePanther FDR schema
  • LogonTypePanther FDR schema · CrowdStrike queries
  • PasswordLastSetPanther FDR schema · CrowdStrike queries
  • RawProcessIdPanther FDR schema
  • RemoteAddressIP4CrowdStrike queries
  • UIDPanther FDR schema · CrowdStrike queries
  • UserGroupsBitmaskPanther FDR schema
  • UserIsAdminPanther FDR schema · CrowdStrike queries
  • UserLogoffTypePanther FDR schema
  • UserLogonFlagsPanther FDR schema
  • UserNamePanther FDR schema · CrowdStrike queries
  • UserPrincipalPanther FDR schema
  • UserSidPanther FDR schema · CrowdStrike queries

Panther's generic schema for all Falcon Data Replicator events adds the sensor and context fields (not every event type fills each one): ComputerName, ConfigBuild, ConfigStateHash, ContextProcessId, ContextThreadId, ContextTimeStamp, Entitlements, FileName, FilePath, InContext, TargetProcessId, TreeId, aid, aip, cid, event_platform, event_simpleName, id, name, timestamp.

What the numbers mean

These fields hold numbers that the Falcon console turns into words. The tables are CrowdStrike's own, from the decoding transforms in its public LogScale content repository, shown as published.

LogonType source ↗︎

0 System
2 Interactive
3 Network
4 Batch
5 Service
6 Proxy
7 Unlock
8 Network Cleartext
9 New Credential
10 Remote Interactive
11 Cached Interactive
12 Cached Remote Interactive
13 Cached Unlock

UserIsAdmin source ↗︎

0 No
1 Yes

AuthenticationId source ↗︎

0 Invalid Luid
996 Network Service
997 Local Service
999 System
1000 Reserved Luid Max

What the record looks like

{
"timestamp": "1705312920000",
"event_simpleName": "UserLogon",
"cid": "abc123def456",
"event_platform": "Win",
"aid": "sensor001",
"ComputerName": "DESKTOP-ALICE",
"UserName": "alice",
"LogonDomain": "CORP",
"LogonType": 2,
"aip": "10.0.0.10"
}

Numbered lines are the fields in the table.

A synthetic record from LogTriage's test corpus, in the shape Falcon Data Replicator writes; every build of this site checks that it uses only fields documented for the event. Real records carry more fields.

What it records

UserLogon is the Falcon sensor’s record of a successful sign-in, written on Windows, macOS and Linux hosts. It names the account (UserName, UserSid, LogonDomain), how the logon happened (LogonType), where it came from for remote and network logons (RemoteAddressIP4, sometimes ClientComputerName), and which server authenticated it (LogonServer). It also describes the account: UserIsAdmin says whether it has administrator rights on the host, UserLogonFlags adds whether it is local or built-in, and PasswordLastSet when its password last changed.

LogonType uses Windows’s values: 2 interactive (at the keyboard), 3 network (a file share, many management tools), 4 batch (scheduled tasks), 5 service, 7 unlock, 10 remote interactive (remote desktop) and 11 cached interactive (a domain account without a domain controller in reach). Times are Unix epoch seconds: LogonTime, and LogoffTime when the session ends. AuthenticationId is the Windows logon session ID, which also appears on the processes started in that session; its well-known values are 999 for SYSTEM, 997 for Local Service and 996 for Network Service. The failed counterpart is UserLogonFailed2.

When it matters

  • Remote desktop from the internet. LogonType 10 with a public RemoteAddressIP4 means RDP is reachable and someone got in (MITRE ATT&CK T1021.001). CrowdStrike publishes queries that map these addresses and flag “impossible travel” between consecutive RDP logons by the same user.
  • A success after failures. A UserLogon from an address that produced UserLogonFailed2 events for the same account minutes earlier means a guessed password worked (T1078).
  • Admin logons where they don’t belong. UserIsAdmin 1 on workstations by accounts that are not help-desk or IT staff, or administrator logons by local accounts (UserLogonFlags 0x4) on servers.
  • Old passwords on exposed accounts. CrowdStrike’s Windows logon dashboard computes password age from PasswordLastSet; an account with a years-old password and remote logons is a prime spraying target.

How to investigate

  1. Filter by account and host, and leave out machine accounts (UserName ending in $) and SYSTEM, as CrowdStrike’s own logon queries do.
  2. For remote logons, check RemoteAddressIP4 against your VPN and office ranges and the IP blocklist checker, and look for failed attempts from the same address before the success.
  3. Follow the session: ProcessRollup2 events on the same aid with the logon’s AuthenticationId are what ran in it; UserLogoff shows when it ended.
  4. Compare with the user’s history — usual hosts, hours and addresses.

Remote desktop logons from public addresses, in Falcon’s event search:

#event_simpleName=UserLogon event_platform=Win LogonType=10 RemoteAddressIP4=*
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16"])
| ipLocation(RemoteAddressIP4)
| groupBy([UserName, RemoteAddressIP4, RemoteAddressIP4.country], function=[count(as=Logons), count(aid, distinct=true, as=Hosts)], limit=max)
| sort(Logons, order=desc)

Administrator logons by person accounts, with password age in days:

#event_simpleName=UserLogon event_platform=Win UserIsAdmin=1 UserSid=S-1-5-21-*
| UserName!=/\$$/
| passwordAgeDays := (now() - (PasswordLastSet * 1000)) / 86400000
| groupBy([UserName, LogonType], function=[count(aid, distinct=true, as=Hosts), max(passwordAgeDays, as=PasswordAgeDays)], limit=max)
| sort(Hosts, order=desc)

Remote desktop logons over Falcon Data Replicator data in Splunk (add your index):

sourcetype="crowdstrike:events:sensor" event_simpleName=UserLogon LogonType=10
| where NOT cidrmatch("10.0.0.0/8", RemoteAddressIP4) AND NOT cidrmatch("172.16.0.0/12", RemoteAddressIP4) AND NOT cidrmatch("192.168.0.0/16", RemoteAddressIP4)
| stats count AS Logons, dc(aid) AS Hosts, values(UserName) AS Users by RemoteAddressIP4
| sort - Logons

The free log analyzer reads Falcon exports in the browser and flags successful logons that follow a burst of failures from the same address.

Where these facts come from

CrowdStrike's event dictionary sits behind the Falcon console login, so the field list above is assembled from public sources that agree with one another, and checked on every build:

A field counts as documented when Panther or Splunk lists it for this event, or when at least two of CrowdStrike's query files read it from this event alone. The explanations are LogTriage's own.

Related events

Detect it

MITRE ATT&CK: T1021.001T1078

Frequently Asked Questions

How do I find remote desktop logons in CrowdStrike Falcon?
Filter UserLogon on LogonType=10, the remote interactive logon type, as CrowdStrike's own RDP world-map query does. RemoteAddressIP4 then holds the client's address, so leaving out private ranges with cidr() shows remote desktop sessions that arrived from the internet, which should be rare or none on most hosts.
What does UserIsAdmin mean in a UserLogon event?
It says whether the account that logged on has administrator rights on that host, 1 for yes and 0 for no; UserLogonFlags carries the same fact as its 0x2 bit, alongside whether the account is local or built-in. Administrator logons on ordinary workstations, or by accounts that are not normally admins, are worth reviewing.
Why are LogonTime and PasswordLastSet such small numbers?
Both are Unix epoch times in seconds, while Falcon's query language works with milliseconds. CrowdStrike's queries multiply them by 1000 before formatTime(), and compute password age as now() minus PasswordLastSet times 1000. In Splunk, strftime() takes seconds directly.
How do I see what a user did after logging on?
Take the logon's aid and AuthenticationId, the Windows logon session ID, and search ProcessRollup2 events on the same aid with that AuthenticationId; those are the processes started in the session. UserLogoff with the same values shows when the session ended.

Find every UserLogon in your own Falcon export

Load a Falcon Data Replicator or event-stream export into the free browser analyzer: suspicious command lines, LSASS access, logon failures, reverse-shell ports and Falcon's own detections are flagged, with event names linked to their pages here. Nothing is uploaded.

Open the free analyzer → Analyze your own logs

Investigating something right now? LogTriage checks every address in the file against threat intelligence and writes the incident report: 10 analyses a month free. The incident pack adds the in-depth AI analysis and files up to 100 MB: 25 analyses for $19, one payment, no subscription. Pricing