← cd ~/events
// events/4648 · Sign-in
Event ID 4648A logon was attempted using explicit credentials
A process tried to log on by explicitly supplying an account's credentials, most often a scheduled task or the RUNAS command.
| Log | Security |
|---|---|
| Source | Microsoft-Windows-Security-Auditing |
| Area | Sign-in |
What to check
Look for high-value accounts, use outside working hours, unexpected process names or paths, and network addresses outside your ranges.
Find it with PowerShell
Run on the machine that logs it, as an administrator.
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4648 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
Security events land in the SecurityEvent table when you collect them with the Windows Security Events connector or a data collection rule.
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4648
| project TimeGenerated, Computer, Account, Activity
| order by TimeGenerated descRelated Sign-in events
- Event ID 4624: An account was successfully logged on
- Event ID 4625: An account failed to log on
- Event ID 4634: An account was logged off
- Event ID 4647: User initiated logoff
- Event ID 4672: Special privileges assigned to new logon
- Event ID 4776: The computer attempted to validate the credentials for an account