4648 Security log · Logon/Logoff high severity medium volume

Windows Event ID 4648 — A logon was attempted using explicit credentials

A process attempted logon with explicitly provided credentials while already logged on (runas, credential injection). Key fields: AccountName, TargetServerName, TargetAccount.

Why event 4648 matters

Classic Pass-the-Hash indicator. Mimikatz sekurlsa::pth generates this. Impacket tools (psexec.py, wmiexec.py) trigger 4648 on source hosts. Key: TargetAccount differs from SubjectAccount AND spawning process is unexpected.

How to detect it

Alert: SubjectUserName != TargetUserName AND process NOT in (runas.exe, mstsc.exe, known admin tools). Alert: any 4648 where TargetAccount is a Domain Admin. Correlate with 4624 Type 9 on the remote target.

Log source
Security
Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameTargetServerNameIpAddress

MITRE ATT&CK mapping

Tactic Technique
Lateral Movement Pass the Hash (T1550.002)
Privilege Escalation Access Token Manipulation (T1134)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Explicit Credential Logon — Possible PtH
status: experimental
description: Logon with explicit credentials where account differs from running account
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4648
    filter_runas:
        ProcessName|endswith: '\\runas.exe'
    condition: selection and not filter_runas
falsepositives:
    - Legitimate runas /netonly usage
    - Scheduled tasks with alternate accounts
level: medium
tags:
    - attack.lateral_movement
    - attack.t1550.002
Sentinel / Defender KQL
SecurityEvent
| where EventID == 4648   // A logon was attempted using explicit credentials
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, TargetServerName, IpAddress
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4648
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A logon was attempted using explicit credentials — add EventData fields: SubjectUserName, TargetUserName, TargetServerName, IpAddress`
Hunt event 4648 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Logon/Logoff events

4624 An account was successfully logged on 4625 An account failed to log on 4626 User/Device claims information 4627 Group membership information 4634 An account was logged off 4647 User initiated logoff 4649 A replay attack was detected 4672 Special privileges assigned to new logon 4778 A session was reconnected to a Window Station 4779 A session was disconnected from a Window Station 4800 The workstation was locked 4801 The workstation was unlocked

Frequently asked questions

What is Windows Event ID 4648?

A logon was attempted using explicit credentials. A process attempted logon with explicitly provided credentials while already logged on (runas, credential injection). Key fields: AccountName, TargetServerName, TargetAccount.

Which log records event 4648?

Event 4648 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4648?

Event 4648 is associated with: Pass the Hash (T1550.002), Access Token Manipulation (T1134).

How do you detect activity around event 4648?

Alert: SubjectUserName != TargetUserName AND process NOT in (runas.exe, mstsc.exe, known admin tools). Alert: any 4648 where TargetAccount is a Domain Admin. Correlate with 4624 Type 9 on the remote target.