An overview of Windows EventID 4648 - Logon with explicit credentials

In this post, we will try to analyse some of the known noisy windows events and see if there are any hidden opportunities or details we are missing because of the high volume  and that we can turn them into our advantage. More importantly for any defender knowing what's normal helps a lot (especially during investigation in post-breach mode where you don't have time ...) to identify the abnormal things. 

This event is qualified as noisy because every time a user, a computer account logon, a service or a task runs this event get logged. Before we start let's agree on the field/attributes of interest in 4648 event:

1. Subject Account Name -> referred to as SourceUserName
2. Account Name -> referred to as DestinationUserName (Alternate Credentials)
3. Process Information -> the process involved in the switch of credentials (i.e. from account-A to account-B)
4. Target Server -> if you do a remote logon with different credentials then the TargetServer will contain info about the destination 
5. Network Information -> if your machine receives a remote authentication from host 1.2.3.4, then you will see in your machine 4648 event this IP address.

A quick search for 3 months period of 4648 event logs from 4 DC yields the following:

As can be seen above, majority of the noise is coming from the following combination of attributes:

• SourceUserName = System
• DestinationUserName = Domain User or Computer AccountName
• Process: *\lsass.exe 

• SourceUserName = System
• DestinationUserName= *$ (Computer Account)
• ProcessName=*\taskhostw.exe or *\taskhost.exe or *\taskeng.exe

• SourceUserName = System
• DestinationUserName = System
• ProcessName=*\service.exe or *\svchost.exe
• Target Server Name: localhost
• Network Address = NULL

• SourceUserName = *$
• DestinationUserName = *
• ProcessName=*\service.exe or *\winlogon.exe
• Target Server Name: localhost
• Network Address = 127.0.0.1 (indicate local interactive logon - 4624 LogonType=2)

 Now let's drill down into some of the interesting 4648's attributes combinations:

A) Inbound RDP:  Process=winlogon.exe and NetworkAddress is not Null nor equal to loopback address and is often associated to a remote interactive logon activity (Logon Type equal 10 or 7)

B) Outbound RDP: SourceUserName != System or *$ and Additional Information contains TERMSRV.

C) Net use x: \\target  /user:example\admin01: EventId 4648 with Logon ProcessID=4 (System, very rare)

D) Remote Service Interaction (using sc.exe with explicit creds):

E) Services running with specific account (other than local SYSTEM or NETWORK SERVICE):

Takeaway:

• Monitor 4648 with process-name different than the top common ones (winlogon.exe, lsass.exe, svchost.exe, task*.exe, mmc.exe, services.exe, consent.exe, w3wp.exe)
• Monitor 4648 with ProcessID=0x4 (System virtual process).
• Monitor 4648 with SourceAccountName different than (System or *$) and SourceAccountName != DestinationAccountNAme
• When investigating RDP activity, pay attention to 4648 with process name equal to winlogon.exe and Network Address is not null nor equal to locahost
• When investigating 4648 events, pay attention to the Additional Information attribute.

References:

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4648