4649 Security log · Logon/Logoff critical severity low volume

Windows Event ID 4649 — A replay attack was detected

The Kerberos subsystem detected a replayed ticket. Same ticket presented more than once.

Why event 4649 matters

Direct indicator of Kerberos ticket replay. Pass-the-Ticket, Golden Ticket, and Silver Ticket attacks can trigger this when a used ticket is replayed. Very low false-positive rate — every occurrence warrants immediate investigation.

How to detect it

Alert on every occurrence. Capture ClientAddress, TargetUserName, ServiceName. Correlate with 4768/4769 for ticket lifecycle. Isolate source host immediately.

Log source
Security
Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic Technique
Credential Access Steal or Forge Kerberos Tickets (T1558)
Lateral Movement Pass the Ticket (T1550.003)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Kerberos Replay Attack Detected
status: stable
description: Kerberos ticket replay — always high priority
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4649
    condition: selection
falsepositives:
    - Rare network issues causing duplicate packet delivery
level: critical
tags:
    - attack.credential_access
    - attack.t1558
    - attack.t1550.003
Sentinel / Defender KQL
SecurityEvent
| where EventID == 4649   // A replay attack was detected
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4649
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A replay attack was detected — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 4649 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Logon/Logoff events

4624 An account was successfully logged on 4625 An account failed to log on 4626 User/Device claims information 4627 Group membership information 4634 An account was logged off 4647 User initiated logoff 4648 A logon was attempted using explicit credentials 4672 Special privileges assigned to new logon 4778 A session was reconnected to a Window Station 4779 A session was disconnected from a Window Station 4800 The workstation was locked 4801 The workstation was unlocked

Frequently asked questions

What is Windows Event ID 4649?

A replay attack was detected. The Kerberos subsystem detected a replayed ticket. Same ticket presented more than once.

Which log records event 4649?

Event 4649 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4649?

Event 4649 is associated with: Steal or Forge Kerberos Tickets (T1558), Pass the Ticket (T1550.003).

How do you detect activity around event 4649?

Alert on every occurrence. Capture ClientAddress, TargetUserName, ServiceName. Correlate with 4768/4769 for ticket lifecycle. Isolate source host immediately.