Back to all events4648AuthenticationWARNLast updated:
Logon using explicit credentials (RunAs)
What it means
A user ran something as another account. A classic manual lateral-movement signal.
First steps
- 1Look at the pair: which user, and which account they switched to.
- 2Switching to an admin account from a normal workstation warrants investigation.
Related events
This reference is a starting point for investigation, not a replacement for your organisation's security policy.