Repeated Failed Logons to System Accounts

Ankit Mehta@Secvyn

•updated Jun 17, 2026•1•0•4

This rule detects repeated failed or successful logon attempts (EventID 4625 or 4624) to sensitive system accounts like 'SYSTEM', 'LOCAL SERVICE', 'NETWORK SERVICE', or 'ADMIN$' from non-system accounts. It specifically looks for interactive (LogonType 10), remote interactive (LogonType 3), or unlock (LogonType 9) logons, and triggers if there are 3 or more such attempts within an hour for the same account and computer.