SOC Event Lookup
Event ID 4649LogonP2

Windows Event ID 4649: A replay attack was detected

Applicable version
Windows Server 2008 R2 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4649 records a Kerberos replay condition where the domain controller returned KRB_AP_ERR_REPEAT to the client.

Technical Metadata

Technical metadata for Event ID 4649
Event ID4649
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0005 Defense Evasion / T1550.003 Use Alternate Authentication Material: Pass the Ticket
Key fields to watchCredentials Which Were Replayed: Account Name / Account Domain, Request Type / Logon Process / Authentication Package, Workstation Name / Process ID / Process Name

Trigger Scenarios

This event is generated on domain controllers when a Kerberos authenticator is replayed: Microsoft documents that the server name, client name, time, and microsecond fields matched recently cached authenticator data.

Key Fields

Credentials Which Were Replayed: Account Name / Account Domain

Identifies the Kerberos client account whose authenticator was replayed. This is the principal to compare with recent 4769 service ticket activity.

Request Type / Logon Process / Authentication Package

Shows the Kerberos request context. Authentication Package should be Kerberos for the replay scenario documented by Microsoft.

Workstation Name / Process ID / Process Name

Provides the client workstation and local process context available in the event schema for triage and packet-path review.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 4649
SecurityEvent
| where EventID == 4649
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 4649
index=wineventlog source="WinEventLog:Security" EventCode=4649
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 4649
dataset = microsoft_windows_raw
| filter edr_event_id = 4649
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4649
title: Windows Security Event ID 4649
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4649
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
RequestTypeKRB_AP_REQThe replay involved a Kerberos application request carrying an authenticator.Together with KRB_AP_ERR_REPEAT semantics and suspicious ticket activity, it supports investigation of replayed Kerberos authentication material. Source
AuthenticationPackageKerberosKerberos processed the replayed credential request.This narrows correlation to Kerberos service-ticket and logon events rather than NTLM credential validation. Source

MITRE ATT&CK Mapping

  • T1550.003Use Alternate Authentication Material: Pass the Ticket

Detection Notes

Use threshold=1 for triage because Event ID 4649 represents KRB_AP_ERR_REPEAT replay detection. T1550.003 Pass the Ticket becomes more plausible when RequestType is KRB_AP_REQ, AuthenticationPackage is Kerberos, and the same account or workstation has abnormal 4769 service-ticket requests or follow-on 4624 network logons; first exclude packet duplication or network-path anomalies.

Common False Positives

  • Microsoft notes that network device configuration or routing problems can replay packets and trigger the same condition.
  • Kerberos infrastructure testing and load balancer changes can create benign repeats, but every occurrence still requires investigation.

Related Events

Sample Log

Sanitized event sample
EventID: 4649
Credentials Which Were Replayed Account Name: svc-web
Account Domain: CORP
Request Type: KRB_AP_REQ
Authentication Package: Kerberos
Workstation Name: WS-042
Process ID: 0x1f4

Frequently Asked Questions

What does Windows Event ID 4649 mean?

Event ID 4649 records that Windows detected a replayed Kerberos authenticator and includes the replayed account, request, process, and workstation context.

Does one Event ID 4649 prove pass-the-ticket activity?

No. Microsoft notes that network configuration problems can produce replay detections; confirm duplicate traffic and correlate the account with abnormal service-ticket and logon activity.

Which events should be correlated with 4649?

Review 4769 service-ticket requests and 4624 logons for the account and workstation, then compare ProcessId and ProcessName with local process telemetry.

Sources