Event ID 4648 records a logon attempt made with explicit credentials in the Windows Security log. It appears when a process supplies another account’s credentials, such as with scheduled tasks or RUNAS, and it can also occur during normal OS activity. Defenders review the subject account, target server, process name, and network address.
What Event ID 4648 Means in Windows Security Logging
Event ID 4648 indicates that a process attempted to log on using explicit credentials, rather than the caller's current security context. In practice, it helps defenders spot when one account is being used to access another system, service, or resource.
This event is most useful when read as part of a chain, not as a standalone alert. A scheduled task, administrative run-as action, or a remote management workflow can all generate it, so the event is a signal to verify intent, not proof of abuse.
Because the log entry is about credential use rather than success or failure, it often complements other Windows security events. Reviewers should treat it as a trace point that helps explain why a later logon, network access, or process action happened.
What to Examine in the Log Entry
The most important fields are the subject account, the target account, the process name, and the network address. Together, those details show who initiated the action, what credentials were supplied, which program used them, and from where the request originated.
That context matters because explicit-credential activity can be benign on an admin workstation and suspicious on a server that rarely uses run-as behavior. A process name that does not fit the host role, or a source address that does not fit the expected management path, deserves closer review.
Event ID 4648 is also easier to interpret when paired with host role knowledge. A jump box, management server, or automation host may generate this event routinely, while the same event on a sensitive application server may indicate credential misuse or an attempted lateral movement path.
Why Event ID 4648 Is Important for Detection
Explicit-credential logons often appear in administrative workflows, but they also provide a visible footprint for techniques that rely on borrowed credentials. When attackers obtain usable credentials, they frequently try to operate as another account instead of creating obvious new access paths.
The event is therefore useful for spotting suspicious privilege use, especially when the initiating process is unusual or the target account has more access than the caller. It can also help explain lateral movement when a legitimate tool is abused to reach another host or service.
For broader Windows visibility, defenders often pair this event with other telemetry. Windows Event Log Guide is useful background for understanding how logon-related events fit into audit policy and investigation workflows, while MITRE ATT&CK Enterprise Matrix helps map suspicious credential use to common attacker behaviors.
How Analysts and Administrators Should Use It
Use Event ID 4648 as a correlation point. On its own, it says that explicit credentials were supplied; its value comes from comparing the event to the host, the account, the process lineage, and any adjacent authentication or network events.
If the event is expected, document the normal process and source pattern so future reviews can separate routine administration from anomalous use. If it is not expected, treat it as a starting point for validating whether the account, system, or automation job is legitimate.
For better context around host-side execution and process creation, Sysmon Guide is helpful because process telemetry and network correlation often make the meaning of a 4648 entry much clearer.
When the credential use involves administrative scripting or remote command execution, PowerShell Security Guide helps explain how logging and execution context can reveal abuse of explicit credentials.
Risk and Threat Considerations
Event ID 4648 can expose credential abuse, but it can also generate noise in environments where administrators routinely use run-as, scheduled tasks, or automation. The risk is that defenders either miss a real misuse pattern or waste time chasing ordinary administrative activity that merely looks unusual in isolation.
Failure mechanism: An attacker or insider with access to valid credentials can use explicit-credential execution to impersonate another account, blend into routine administration, or move laterally while leaving only a log trail that looks operational unless it is correlated.
Impact: If investigators ignore the event, they may miss early signs of stolen-credential use, unauthorized privilege access, or remote execution that later leads to broader compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1078 — Valid Accounts | Event ID 4648 can show explicit use of valid credentials by an account. |
| T1021 — Remote Services | Explicit-credential logons often precede remote access and administrative movement. | |
| Recommendation — Correlate 4648 with adjacent activity to hunt for valid-account misuse and lateral movement. Trace 4648 alongside remote service use to confirm whether the access path was expected. | ||
| NIST SP 800-53 Rev 5 | AU-12 — Audit Record Generation | Windows Security logging depends on capturing the event data needed for review. |
| AU-6 — Audit Record Review, Analysis, and Reporting | This event is valuable only when analysts review it with surrounding context. | |
| AC-6 — Least Privilege | Explicit-credential use becomes riskier when accounts hold more access than they need. | |
| Recommendation — Ensure audit generation is enabled so explicit-credential logons are recorded consistently. Review 4648 events with process, account, and source context to distinguish normal from suspicious use. Restrict account privilege so explicit-credential use cannot become easy privilege escalation. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The event is a logging artifact that depends on central log collection and review. |
| Recommendation — Collect and review Windows security logs centrally so 4648 activity is visible for detection. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and network services are monitored to detect potentially adverse events | 4648 is most useful when monitored as part of broader detection telemetry. |
| Recommendation — Monitor logon-related telemetry so explicit-credential activity is detected in context. | ||
Practitioner Guidance
What to watch for: Focus on unexpected subject accounts, unusual target accounts, rare process names, and source addresses that do not match the host's normal administrative pattern. Those are the cues that turn a routine-looking 4648 entry into a meaningful investigation.
Governance implication: Teams should define which hosts, accounts, and tools are allowed to generate explicit-credential events so reviewers can distinguish approved administration from suspicious credential use. That baseline is especially important on tiered admin systems and servers that should not be used interactively.
Practitioner takeaway: Treat Event ID 4648 as an attribution event, not an alert by itself; its value comes from proving which process used which credentials, and from where, so the rest of the log story can be validated.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org