Event ID 4648: A logon was attempted using explicit credentials
Written when a process logs on with credentials typed in or passed explicitly, rather than the current user's own: runas, mapped drives with another account, PsExec with -u.
- Log
- Security
- Category
- Logon
Why it matters
- Common in lateral movement, when an attacker uses stolen credentials from a compromised workstation.
- Shows both the account that was logged in and the account whose credentials were used, plus the target server.
What to check
Compare Subject (who ran it) with Account Whose Credentials Were Used, and check Target Server Name and Process Name.
How to turn it on
Advanced Audit Policy: Logon/Logoff > Audit Logon (Success).
MITRE ATT&CK
- T1078 Valid Accounts