Skip to main content

​
Overview

The LogonSessions command enumerates active Windows logon sessions on the system. This reveals who is currently logged on, their logon type, authentication package used, and session details - critical information for understanding current user activity and potential token theft targets.

​
Syntax

Seatbelt.exe LogonSessions

​
Remote Execution

Seatbelt.exe LogonSessions -computername=TARGET.domain.com [-username=DOMAIN\user -password=pass]

​
Output

Returns logon session information:
  • Username and domain
  • Logon ID (LUID)
  • Logon type (Interactive, Network, Batch, Service, etc.)
  • Authentication package (NTLM, Kerberos, Negotiate)
  • Logon time
  • Logon server
  • DNS domain name
  • User SID

​
Use Cases

  • Red Team
  • Blue Team
  • Identify high-value targets for token theft
  • Find interactive admin sessions
  • Discover service account logons
  • Plan token impersonation attacks
  • Identify lateral movement opportunities
  • Locate cached credentials

​
Example Output

====== LogonSessions ======

UserName               : CORP\administrator
LogonDomain           : CORP
LogonId               : 0x54321
LogonType             : Interactive
AuthenticationPackage : Kerberos
LogonTime             : 10/15/2024 8:30:15 AM
LogonServer           : DC01
DnsDomainName         : corp.local
Upn                   : administrator@corp.local
UserSID               : S-1-5-21-123456789-123456789-123456789-500

UserName               : CORP\svc_sql
LogonDomain           : CORP
LogonId               : 0x98765
LogonType             : Service
AuthenticationPackage : Negotiate
LogonTime             : 10/14/2024 6:45:22 PM
LogonServer           : DC01
DnsDomainName         : corp.local

​
Remote Execution

This command supports remote execution using the -computername parameter.

​
Detection Considerations

Logon session enumeration is a common precursor to credential access.
  • API Calls: Uses LsaEnumerateLogonSessions and LsaGetLogonSessionData
  • Privilege Required: May require elevated privileges
  • WMI Activity: Remote execution generates WMI events
  • EDR Telemetry: Often flagged by security products