Passive Logon-Session Enumeration via remote_logon C2 Message With No Matching Auth Event in Window (TAG-195)

Duo Tech@duotech

•updated Jul 24, 2026•0•0•2

Detects the remote_logon C2 command token correlated with an absence of a matching auth event, indicating passive logon-session enumeration.