How to grab credentials given when user clicks on run as different user?

Question

I have that when we click on run as admin we get an event to credential provider as CPUS_CREDUI. I want to know when we click on run as different user, why aren't we getting an event for credential provider. Is their any way to grab the credentials given by user when he clicks on run as different user?

Thank you in advance

Answer 1

Hello there,

The simplest way would be to capture the 4648(S) Event ID and trace the credentials that were being used when this Event ID is triggered.

This event is generated when a process attempts an account logon by explicitly specifying that account’s credentials.

4648(S): A logon was attempted using explicit credentials. https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648

This event is also logged when a process logs on as a different account such as when the Scheduled Tasks service starts a task as the specified user.

---------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer–

Answer 2

How to capture the event and trace the values?