SOC Event Lookup
Event ID 4648LogonP1

Windows Event ID 4648: A logon was attempted using explicit credentials

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4648 records a process attempting to authenticate with explicitly supplied credentials, making it valuable for investigating credential use and lateral movement.

Technical Metadata

Technical metadata for Event ID 4648
Event ID4648
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0005 Defense Evasion / T1078 Valid Accounts
Key fields to watchSubject, Account Whose Credentials Were Used, Target Server Name / Network Address

Trigger Scenarios

Windows logs this event when a caller supplies a username and password to access a local or remote resource rather than using the current session token.

Key Fields

Subject

The account and process that initiated the credential use. Compare it with the account whose credentials were supplied.

Account Whose Credentials Were Used

The target identity. Privileged, dormant, or service accounts used from unusual hosts deserve immediate review.

Target Server Name / Network Address

The destination resource and remote address. These fields identify the potential lateral-movement target.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Event ID 4648
SecurityEvent
| where EventID == 4648
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Microsoft Sentinel Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Event ID 4648
index=wineventlog source="WinEventLog:Security" EventCode=4648
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before implementing event-specific filtering or aggregation.
Cortex XQL: Retrieve Event ID 4648
dataset = microsoft_windows_raw
| filter edr_event_id = 4648
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The relevant Windows event channel is ingested through a Cortex XDR Windows event collection path. Inspect raw provider fields because parsed field names vary by collection path and event provider.
Query reference
Sigma rule: Windows Event ID 4648
title: Windows Event ID 4648
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4648
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

MITRE ATT&CK Mapping

  • T1078Valid Accounts

Detection Notes

T1078 credential abuse is signaled when Account Whose Credentials Were Used is a privileged or service identity while Subject is a standard user, and Target Server Name is a new server. runas.exe, cmdkey.exe, or powershell.exe in Process Name followed by a Type 3 or Type 10 4624 is a concrete lateral-movement sequence.

Common False Positives

  • RunAs, scheduled tasks, backup systems, and deployment tools can use explicit credentials legitimately.
  • Administrative support staff may use alternate accounts to access servers or shares.

Related Events

Sample Log

Sanitized event sample
Subject: CORP\jsmith
Account Whose Credentials Were Used: CORP\admin.ops
Target Server Name: FILE01
Process Name: C:\Windows\System32\runas.exe
Network Address: 10.x.x.x

Frequently Asked Questions

What does Windows Event ID 4648 mean?

Event ID 4648 records an attempt to use explicitly supplied credentials, commonly through RUNAS or a process that calls LogonUser with explicit account data.

Does 4648 mean the supplied credentials succeeded?

No. It records the explicit-credential attempt; correlate with later authentication and logon events on the target system to establish success.

Why is Event ID 4648 useful for lateral-movement analysis?

It identifies the originating subject, the account whose credentials were supplied, the process, and the target server, allowing analysts to spot credential switching and unexpected remote targets.

Sources