Event ID 4648: logon with explicit credentials
What Event ID 4648 (logon with explicit credentials) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.
Event ID 4648 means a process used credentials other than the ones the user logged on with. That covers ordinary things like runas and mapped drives with a different account, and also how many lateral-movement tools work. The process name and the target server tell you which.
The fields that matter
| Field | What it tells you |
|---|---|
| Subject | The logged-on user whose process did this. |
| Account Whose Credentials Were Used | The other account. |
| Target Server Name | Where the credentials were used. localhost is common and usually benign. |
| Process Name | The program that used them, such as runas.exe, svchost.exe or a remote admin tool. |
| Network Address | The target address when it is remote. |
What is normal
runas by IT staff, scheduled tasks, backup agents and mapped drives that use a separate admin account.
When Event ID 4648 is suspicious
- A standard user's workstation using a domain admin account against several servers.
- Process names such as
powershell.exe,cmd.exe,wmic.exeor tools in user folders using explicit credentials. - Explicit credentials used against many targets in a short time from one host.
Common false positive: Windows itself logs 4648 for some local operations with localhost as the target. Filter those before looking at remote targets.
Find Event ID 4648 with PowerShell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4648; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
ForEach-Object {
$d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
[pscustomobject]$d
} | Format-ListMicrosoft Sentinel (KQL)
SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 4648
| project TimeGenerated, Computer, Account, Activity, EventData
| order by TimeGenerated descRelated events
- Event ID 4624: Successful logon
- Event ID 4672: Special privileges assigned to new logon
- Event ID 4688: New process created
FAQ
Is 4648 logged on the source or the target?
On the machine where the process ran, the source. The target records its own 4624.
Does every runas create a 4648?
Yes, and so does runas /netonly, which also produces a type 9 logon (4624) on the same machine.
Windows Event Triage reads a CSV, EVTX-to-JSON or XML export in your browser and flags brute force, new admins, suspicious services and log clearing.
IOC Triage, our free browser extension: right-click it for a verdict from 15 threat-intel sources, then copy a ready ticket note.