Potentially Suspicious Explicit Credential Local Logon

Title: Potentially Suspicious Explicit Credential Local Logon
Status: experimental
Description:Detects potentially suspicious explicit credential logon events where the user is trying to logon with explicit credentials (username and password) that are different from the current user context. It might indicate an attacker attempting to escalate privileges after obtaining credentials for a different user account.
References:
  -https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648
  -https://github.com/MSNightmare/LegacyHive
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-07-23
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.stealth'
• -'attack.t1134'
• -'attack.t1134.003'

Logsource:

• product: windows
• service: security

Detection:
  selection_eid:
    EventID: '4648'
  selection_localhost:
TargetServerName:'localhost' TargetInfo:'localhost'     - IpAddress:
      - '127.0.0.1'
      - '::1'
  filter_main_computer_accounts:
    SubjectUserName|endswith: '$'
  filter_main_system_processes:
    ProcessName|startswith:
      -'C:\Windows\System32\'
      -'C:\Windows\SysWOW64\'
      -'C:\Windows\WinSxS\'

  filter_main_program_files:
    ProcessName|startswith:
      -'C:\Program Files\'
      -'C:\Program Files (x86)\'

  filter_main_same_user:
    SubjectUserName|fieldref: 'TargetUserName'
  condition:all of selection_* and not 1 of filter_main_*
Falsepositives:
  -RunAs usage from user-installed applications outside Program Files
  -Administrative scripts using explicit credentials from non-standard paths
Level: medium