Windows Event ID 4648 – Microsoft-Windows-Security-Auditing: Logon Attempted Using Explicit Credentials

Start by examining the event details to understand the credential usage context.

1. Open Event Viewer → Windows Logs → Security
2. Filter for Event ID 4648 using Filter Current Log
3. Double-click the event to view detailed information
4. Focus on these key fields:
   • Subject: Current user session details
   • Account Whose Credentials Were Used: Target account information
   • Target Server: Destination system or service
   • Process Information: Application that initiated the request
5. Note the Logon Type field to understand the authentication method
6. Check Network Information for source IP addresses in network scenarios

Use PowerShell to efficiently query and analyze 4648 events across multiple systems.

1. Query recent 4648 events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4648} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

2. Filter by specific user account:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4648} | Where-Object {$_.Message -like "*username*"} | Format-Table TimeCreated, Message -Wrap

3. Extract structured data from events:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4648} -MaxEvents 100
   foreach ($Event in $Events) {
       $XML = [xml]$Event.ToXml()
       $SubjectUserName = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
       $TargetUserName = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
       Write-Output "$($Event.TimeCreated): $SubjectUserName used credentials for $TargetUserName"
   }

4. Export events for analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4648} | Export-Csv -Path "C:\Temp\Event4648_Analysis.csv" -NoTypeInformation

Investigate 4648 events across multiple systems to track credential usage patterns.

1. Create a list of target computers:

   $Computers = @('Server01', 'Server02', 'Workstation01')

2. Query events from multiple systems:

   $Results = Invoke-Command -ComputerName $Computers -ScriptBlock {
       Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4648; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue
   } | Select-Object PSComputerName, TimeCreated, Id, Message

3. Analyze credential usage patterns:

   $Results | Group-Object PSComputerName | Select-Object Name, Count | Sort-Object Count -Descending

4. Search for specific credential usage:

   $SuspiciousAccount = "admin_account"
   $Results | Where-Object {$_.Message -like "*$SuspiciousAccount*"} | Format-Table PSComputerName, TimeCreated, Message -Wrap

5. Generate summary report:

   $Results | Export-Csv -Path "C:\Reports\Network_4648_Analysis_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

Correlate 4648 events with related authentication events for comprehensive analysis.

1. Query correlated authentication events:

   $StartTime = (Get-Date).AddHours(-1)
   $EndTime = Get-Date
   $AuthEvents = Get-WinEvent -FilterHashtable @{
       LogName='Security'
       Id=4624,4625,4648,4672
       StartTime=$StartTime
       EndTime=$EndTime
   } | Sort-Object TimeCreated

2. Create correlation analysis:

   $CorrelatedEvents = @()
   foreach ($Event in $AuthEvents) {
       $XML = [xml]$Event.ToXml()
       $EventData = @{
           TimeCreated = $Event.TimeCreated
           EventId = $Event.Id
           Computer = $Event.MachineName
       }
       
       switch ($Event.Id) {
           4648 {
               $EventData.SubjectUser = ($XML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
               $EventData.TargetUser = ($XML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
               $EventData.EventType = "Explicit Credentials"
           }
           4624 {
               $EventData.TargetUser = ($XML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
               $EventData.LogonType = ($XML.Event.EventData.Data | Where-Object {$_.Name -eq 'LogonType'}).'#text'
               $EventData.EventType = "Successful Logon"
           }
       }
       $CorrelatedEvents += New-Object PSObject -Property $EventData
   }

3. Analyze privilege escalation patterns:

   $PrivilegeEvents = $CorrelatedEvents | Where-Object {$_.EventId -eq 4672 -or ($_.EventId -eq 4648 -and $_.TargetUser -like "*admin*")}

4. Generate timeline analysis:

   $CorrelatedEvents | Sort-Object TimeCreated | Format-Table TimeCreated, EventId, EventType, SubjectUser, TargetUser -AutoSize

Examine system configuration that affects 4648 event generation and audit policies.

1. Check audit policy settings:

   auditpol /get /subcategory:"Logon"

2. Verify security audit registry settings:

   Get-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Security" | Select-Object MaxSize, Retention

3. Check Group Policy audit settings:

   gpresult /h C:\Temp\GPResult.html
   # Review Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration

4. Examine LSA audit settings:

   Get-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" | Select-Object auditbaseobjects, fullprivilegeauditing

5. Review event log configuration:

   wevtutil gl Security

6. Configure enhanced auditing if needed:

   # Enable detailed logon auditing
   auditpol /set /subcategory:"Logon" /success:enable /failure:enable
   # Enable credential validation auditing
   auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable