ZEKASTRA

SecurityLogon and session

4648 · A logon was attempted using explicit credentials

Generated when a process attempts a logon by explicitly specifying an account's credentials, for example with RUNAS or in batch configurations such as scheduled tasks.

01Fields in the event

  • SubjectUserName
  • SubjectLogonId
  • LogonGuid
  • TargetUserName
  • TargetDomainName
  • TargetServerName
  • TargetInfo
  • ProcessId
  • ProcessName
  • IpAddress
  • IpPort

02How to use it

Shows which logged-on account used which other account's credentials, from which process and towards which server. Correlate ProcessId with 4688 and SubjectLogonId with 4624; it is a key source for lateral-movement analysis on the originating host.

03Caveats

Requires Audit Logon. It is also a routine event during normal operating system activity, so volume alone is not suspicious.

05Sources

  1. Microsoft Learn — 4648(S) A logon was attempted using explicit credentials checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.