Weekend User Authentication Activity - Potential Insider Threat or Compromised Credential

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•4

This rule monitors for successful and failed user authentication events (Logon events 4624 and 4625) occurring on Saturdays or Sundays. It calculates a risk score based on the volume of authentication attempts and classifies the activity, providing visibility into potential off-hours credential misuse or insider threat scenarios.