Detection of Suspicious Explicit Credential Local Logon

This brief details a detection engineering approach for identifying suspicious use of explicit credentials within a Windows environment. Windows Event ID 4648 is generated when a process attempts to log on to a local or remote resource using explicit credentials, such as when using the 'runas' command. While this is a legitimate administrative function, attackers frequently leverage this technique to escalate privileges or move laterally after harvesting credentials from memory or local configuration files. This rule specifically targets local logon attempts where the process executing the request originates from non-standard directories and does not match the current user context, effectively filtering out common system-managed or administrative activity to highlight potential abuse.

Impact

Successful abuse of explicit credentials allows an attacker to bypass standard access controls, impersonate other users (including high-privilege service accounts or domain administrators), and maintain persistence within the target system. This technique is often a critical stage in the progression from initial access to full domain compromise.

Recommendation

Deploy the provided Sigma rule to your SIEM environment to detect deviations from established administrative patterns.

• Enable Windows Security Auditing (specifically "Audit Logon" subcategory) to ensure Event ID 4648 is generated.
• Baseline common administrative tools used in the environment to tune the 'filter_main_*' selections and minimize false positives.
• Alert on occurrences that bypass current filters, as these represent high-interest activity for manual threat hunting.