Event ID 4648: a logon was attempted using explicit credentials

Event 4648 is written on the computer where someone typed or used other credentials – runas, a drive mapped as another user, a Remote Desktop connection with saved credentials, a scheduled task. It is the outgoing side: it tells you which account was used from here, to which Server. That makes it one of the best events to see an attacker moving from one machine to the next.

1. Where to find it

Security log, Event 4648, audit subcategory Logon (on by default). It appears on the computer the credentials were used from. Many entries come from Windows itself (the computer account, lsass.exe, svchost.exe) and can be ignored.

2. The fields that matter

• Subject › Account Name (SubjectUserName): who was logged on here.
• Account Whose Credentials Were Used (TargetUserName, TargetDomainName): the other account.
• Target Server Name (TargetServerName): where the credentials went – localhost for runas.
• Process Name (ProcessName): runas.exe, mstsc.exe, explorer.exe (mapped drive), taskeng/svchost.exe (scheduled task) – or an unknown tool.
• Network Address (IpAddress): filled when the logon was made from another computer.

3. PowerShell: which credentials went where

function Get-EventFields($e) { $d = [ordered]@{}; ([xml]$e.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }; [pscustomobject]$d }
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4648; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  ForEach-Object { $f = Get-EventFields $_
    if ($f.SubjectUserName -notlike '*$' -and $f.TargetServerName -ne 'localhost') {
      [pscustomobject]@{ Time = $_.TimeCreated; By = $f.SubjectUserName; Used = "$($f.TargetDomainName)\$($f.TargetUserName)"; Target = $f.TargetServerName; Program = Split-Path $f.ProcessName -Leaf } } } |
  Group-Object By, Used, Target, Program | Sort-Object Count -Descending | Select-Object Count, Name

Accounts ending in $ are computer accounts – Windows itself – and are left out.

4. Normal or attack?

• Normal: an admin using runas or Remote Desktop with their admin account from their admin workstation; a drive mapped with a service account; scheduled tasks running as a configured account.
• Suspicious: a domain admin account used from an ordinary user PC; one account reaching many Servers within minutes; PSEXESVC, wmic.exe, powershell.exe or an unknown program as the process; activity at night.

Cross-check on the target: a matching 4624 (logon type 3 or 10) at the same time, and often a new service (7045) when a remote-execution tool was used.

5. Let Coinetic watch it for you

Coinetic works where most of these logons start – on the way in:

• Password guessers are banned automatically by a Windows Firewall rule after a few failed logons – Remote Desktop, Windows logons, VPN, SQL Server and more.
• Remote Desktop invisible until you need it: the port stays closed and opens only after you unlock it from your phone.
• Ask AI (Pro + AI): “Is someone guessing passwords on this Server?” – answered in plain words from this computer's failed logons and bans.

More guides: all Coinetic guides.

Frequently asked

Why does every Remote Desktop connection create a 4648?

When the Remote Desktop client (mstsc.exe) sends saved or typed credentials, Windows logs that as explicit credentials on the computer you connect from. That is normal.

Is 4648 logged on the target Server?

No, on the source. The target logs the logon itself (4624). Matching both by time and account shows the path.

Many 4648 from lsass.exe or svchost.exe - a problem?

Usually not. Windows services use explicit credentials constantly; focus on real user accounts and on target Servers other than localhost.