((EventID:4624 SubjectUserSid:S\-1\-0\-0 LogonType:3 LogonProcessName:NtLmSsp KeyLength:0) OR (EventID:4624 LogonType:9 LogonProcessName:seclogo)) (-TargetUserName:ANONYMOUS\ LOGON)