---
title: Windows new external network logon from public IP
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Windows new external network logon from
  public IP
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Windows new external network logon from public IP

{% alert level="danger" %}
This rule is part of a beta feature. To learn more, [contact Support](https://docs.datadoghq.com/help/).
{% /alert %}
Classification:attackTactic:[TA0001-initial-access](https://attack.mitre.org/tactics/TA0001)Technique:[T1078-valid-accounts](https://attack.mitre.org/techniques/T1078) 
## Goal{% #goal %}

Detects successful network logons to Windows from non-private client IP addresses. A signal is raised when the source IP address is newly observed for the target user account after the learning period completes.

## Strategy{% #strategy %}

This rule monitors Windows Security events where `@evt.id` is `4624` and `@Event.EventData.Data.LogonType` is `3` (network logon). LogonType 3 covers any network-based authentication including SMB file share access, named pipes, WMI, and scheduled task authentication. Events are limited to client addresses that are not classified as private internal networks. The detection tracks `@network.client.ip` for each `@Event.EventData.Data.TargetUserName`. After the learning period, a signal is raised for any network logon from a source IP the account has not previously used.

## Triage and response{% #triage-and-response %}

- Verify on `{{host}}` whether `{{@Event.EventData.Data.TargetUserName}}` is expected to authenticate over the network from external IPs and whether `{{@network.client.ip}}` matches a known ISP, VPN exit, or partner network for that user.
- Review recent sign-in history and account lifecycle changes (new hire, role change, break-glass use) that would explain a first-time source IP for that account.
- Examine adjacent security events on the same host around the logon time for failed attempts, privilege changes, or lateral movement indicators such as file share enumeration or service installations that would support follow-on activity.