Certificate-Based Logon via Schannel or PKU2U

Lacey Cochrane@NullVectorX

•updated Sep 3, 2026•13•0•9

Detects successful logon events (Event ID 4624) utilizing Schannel (TLS client certificate) or PKU2U (peer authentication) logon processes. This behavior may indicate an attacker using forged or stolen certificates to authenticate against a system, potentially bypassing Kerberos-based authentication monitoring.