High Volume of System Account Logons
This rule detects an unusually high volume (5 or more within an hour) of successful logons by 'SYSTEM' or 'LOCAL SERVICE' accounts. While these are legitimate system accounts, a sudden surge in their logon activity could indicate unusual system behavior, potential compromise, or misconfiguration leading to excessive system account usage.
Microsoft Sentinel (KQL)
