Explicit Credentials on the Source Machine
Event 4648 in the Security log and logon type 9, read where a credential switch began.
Why It Matters
When a process uses credentials other than its session's own, the machine it runs on records it and names the target. That ties a logon on a server back to the machine it came from and the account behind it.
What Happens
Windows writes event 4648 to the Security log on the machine where a process used an account's credentials explicitly, most often through RunAs or a scheduled task. It names the account that asked (Subject), the Account Whose Credentials Were Used, the Target Server Name and the Process Name.
Target Server Name is localhost when the credentials were used on the same machine, and any other name says where they went. On that target, events 4624 and 5140 in its Security log record only the account whose credentials were used, so the 4648 on the source is often the only link back to the account that used them.
A NewCredentials logon, written as event 4624 with Logon Type 9 in the source's Security log, keeps the session's own identity and uses the other credentials only on the network.
Windows also writes 4648 to the Security log during routine work, so look for patterns. A burst naming many different accounts, or an admin account used from a machine that is not an admin workstation, stands out.
Reading Event 4648
Event 4648 in the Security log names two accounts, the one that asked and the one whose credentials were used. Read these four fields together to see who switched to which account, where and with what program.
| Field | What It Tells You |
|---|---|
| Subject\Account Name | The account that asked to log on with the credentials |
| Account Whose Credentials Were Used | The account the credentials belong to |
| Target Server Name | Where they were used, and localhost means this machine |
| Process Name | The program that used them |
What Is Logged
Each event below names the log it is written to, the machine that writes it and the audit setting that switches it on, then what to read in it for this page.
| Event and Log | Written On | Switch It On | What It Tells You |
|---|---|---|---|
| 4648 A logon was attempted using explicit credentials (opens in a new tab) Security log | The computer the credentials were used from | Audit Logon | Read Subject, Account Whose Credentials Were Used, Target Server Name and Process Name on the source machine. |
| 4624 An account was successfully logged on (opens in a new tab) Security log | The computer that was logged on to | Audit Logon | On the source it shows Logon Type 9 (NewCredentials), and on the target it records the logon the switched credentials produced.Reading Logon Events explains how to read it. |
| 5140 A network share object was accessed (opens in a new tab) Security log | The server that holds the share | Audit File Share | On the target it records the share the new account opened, with its Source Address. |
Check It on a Machine
These Windows Registry keys hold the settings this page names. Open one to see where it lives and how to read it on a machine.
Attacks That Hook in Here
These attacks work through what this page describes. Each card says what the attack is and, where it uses one of these steps, what it does there.
- Password Spraying
One guessed password tried against many accounts, over Kerberos and NTLM.
- Pass-the-Hash
Signs in over NTLM with a stolen NT hash, never needing the password.
- Overpass-the-Hash
Uses a stolen NT hash or AES key to get a real TGT, turning a hash into Kerberos.
Hunt It
Each tool below runs the same search. Its note names the log or table it reads and what has to be switched on or collected first.
Reads the DeviceLogonEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint, for the target side, which is logons on other machines whose source is ws-042. The 4648 record itself is in ws-042's own Security log.
// Logons on other machines that came from ws-042, the target side of any 4648 written thereDeviceLogonEvents| where Timestamp > ago(Sources
- Microsoft Learn: Security Event 4648 (opens in a new tab)
- Microsoft Learn: Security Event 4624 (opens in a new tab)
- Microsoft Learn: Administrative Tools and Logon Types (opens in a new tab)
- Microsoft Learn: Security Event 5140 (opens in a new tab)
- Velociraptor: Windows.EventLogs.ExplicitLogon (opens in a new tab)