Skip to content

Instantly share code, notes, and snippets.

@DaveRandom

DaveRandom/InteractiveLogons.xml

Last active March 11, 2025 16:11
Show Gist options
  • Save DaveRandom/288dc9e7003aad03a82c08ed843a26e1 to your computer and use it in GitHub Desktop.
Save DaveRandom/288dc9e7003aad03a82c08ed843a26e1 to your computer and use it in GitHub Desktop.
Download ZIP
Windows log filter for finding interactive logon events
Raw
InteractiveLogons.xml
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
Event[
System[EventID=4624]
]
[
EventData[
Data[@Name='LogonType']
and (Data=2 or Data=7 or Data=10 or Data=11)
]
]
</Select>
</Query>
</QueryList>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment