Question

During an investigation, an analyst reviews the Windows Security event log on a workstation and finds an Event ID 4624 with 'Logon Type: 10' occurring shortly before suspicious activity. What does this log entry most likely indicate?

Accepted Answer

A successful remote interactive logon, such as a Remote Desktop (RDP) session

Answer

A successful interactive logon performed physically at the machine's console

Answer

A failed logon attempt due to an incorrect password

Answer

A service account starting a background Windows service