AnalysisConstructed
Mini-guide: the five fields of a 4624 that decide what a logon means
Event 4624 has more than twenty fields and most triage reads two of them. The five that change the conclusion, what each one is really recording, and the values that catch people out.
T1078