Multiple Local Logons by SYSTEM Account

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

This rule detects an unusual number of local or remote interactive logons (LogonType 2 or 10) by the 'SYSTEM' account within a one-hour window. While the SYSTEM account is legitimate, direct interactive logons are rare and multiple occurrences could indicate an attempt to escalate privileges or maintain persistence by an attacker.