DS0028

DS0028Logon Session

ATT&CK
14.1
References
2

Description

Logon occurring on a system or resource (local, domain, or cloud) to which a user/device is gaining access after successful authentication and authorization(Citation: Microsoft Audit Logon Events)

References

  1. https://attack.mitre.org/datasources/DS0028
  2. https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

Data component
Logon Session Creation
Data component
Logon Session Metadata
Data source
User Account
Data source
Application Log
Data source
Active Directory
Data component
User Account Authentication
Sourced from MITRE ATT&CK Enterprise 14.1. Curated by Adam Lundqvist, SQUR.