Windows Events
The Netlogon service created a secure channel with a client with RC4
Event ID 5840
System
Main fields
IP address
IP
Windows
IP
ELK
-
Microsoft Sentinel
-
QRadar
-
Splunk
-
Computer name
Computer
Windows
Computer
ELK
winlog.computer_name
Microsoft Sentinel
-
QRadar
-
Splunk
-
User name
param1
Windows
param1
ELK
winlog.event_data.param1
Microsoft Sentinel
-
QRadar
-
Splunk
-
Important field
param4
Windows
param4
ELK
winlog.event_data.param4
Microsoft Sentinel
-
QRadar
-
Splunk
-
Fields
| Windows Raw | Windows | ELK | Microsoft Sentinel | QRadar | Splunk |
|---|---|---|---|---|---|
| param1 | param1 | winlog.event_data.param1 | - | - | - |
| param2 | param2 | winlog.event_data.param2 | - | - | - |
| param3 | param3 | winlog.event_data.param3 | - | - | - |
| param4 | param4 | winlog.event_data.param4 | - | - | - |
| param5 | param5 | winlog.event_data.param5 | - | - | - |
| IP System field | IP System field | - | - | - | - |
| Computer System field | Computer System field | winlog.computer_name | - | - | - |
| ProcessID System field | ProcessID System field | winlog.process.pid | - | - | - |
| ThreadID System field | ThreadID System field | winlog.process.thread.id | - | - | - |
Sample Event
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="NETLOGON" />
<EventID Qualifiers="0">5840</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2026-08-02T14:45:56.5572547Z" />
<EventRecordID>5999</EventRecordID>
<Correlation />
<Execution ProcessID="848" ThreadID="0" />
<Channel>System</Channel>
<Computer>DC.socpedia.net</Computer>
<Security />
</System>
- <EventData>
<Data>GHOSTPYUVHAOB$</Data>
<Data>socpedia.net.</Data>
<Data>Domain Member</Data>
<Data>192.168.0.237</Data>
<Data>600fffff</Data>
</EventData>
</Event>Windows System Event ID 5840 is a warning logged by the Netlogon service on a domain controller. It indicates that the domain controller established a secure channel with a client using the weak RC4 encryption algorithm.
This warning is related to security updates addressing CVE-2022-38023, a Netlogon RPC elevation-of-privilege vulnerability.
What it means
- Source: NETLOGON (System log)
- Cause: A device or domain member is connecting to the Active Directory domain controller using RC4 encryption instead of stronger AES algorithms.
- Context: This event may occur frequently after Microsoft security-hardening updates are installed. These updates monitor or restrict the use of legacy cryptographic algorithms in Netlogon secure channels.