Active Directory Lateral Movement Detection: Threat Research Release, November 2021 | Splunk
Windows RDP-Related Event Logs: The Client Side of the Story
![4648: A Logon was Attempted Using Explicit Credentials [Fix]](https://cdn.windowsreport.com/wp-content/uploads/2022/12/Untitled-design-22.png "4648: A Logon was Attempted Using Explicit Credentials [Fix]")
4648: A Logon was Attempted Using Explicit Credentials [Fix]
Windows ID 4648 "A logon was attempted using explicit credentials" - @port139 Blog
4776(S, F) The computer attempted to validate the credentials for an account. - Windows Security | Microsoft Learn
Chapter 5 Logon/Logoff Events
Threat Hunting Using Windows Security Log - Security Investigation
Windows ID 4648 "A logon was attempted using explicit credentials" - @port139 Blog
Windows ID 4648 "A logon was attempted using explicit credentials" - @port139 Blog
MENASEC - Applied Security Research: An overview of Windows EventID 4648 - Logon with explicit credentials
Trimarc Research: Detecting Password Spraying with Security Event Auditing
MENASEC - Applied Security Research: An overview of Windows EventID 4648 - Logon with explicit credentials
MENASEC - Applied Security Research: An overview of Windows EventID 4648 - Logon with explicit credentials
Using the Convert-EventLogRecord function alongside the Get-WinEvent PowerShell cmdlet to search Windows event logs – 4sysops
PsExec and NTUSER data - Digital Forensics & Incident Response
Windows ID 4648 "A logon was attempted using explicit credentials" - @port139 Blog
Windows ID 4648 "A logon was attempted using explicit credentials" - @port139 Blog
AppInsight for Active Directory Alert is not really helpful ? - Forum - Server & Application Monitor (SAM) - THWACK
Fix Event ID 4648 A Logon Was Attempted Using Explicit Credentials - YouTube
Detecting Lateral Movement 101 (Part-2): Hunting for malcode Execution via WMI using Windows Event Log Analysis | by imp hash | Medium
Windows Security Log Event ID 4648 - A logon was attempted using explicit credentials
Windows Event ID 4648 - ArcSight User Discussions - ArcSight
4648(S) A logon was attempted using explicit credentials. - Windows Security | Microsoft Learn
Windows ID 4648 "A logon was attempted using explicit credentials" - @port139 Blog
Making Sense of RDP Connection Event Logs | FRSecure
Windows ID 4648 "A logon was attempted using explicit credentials" - @port139 Blog
![4648: A Logon was Attempted Using Explicit Credentials [Fix]](https://cdn.windowsreport.com/wp-content/uploads/2022/12/image-1-6.jpg "4648: A Logon was Attempted Using Explicit Credentials [Fix]")