We stumbled upon Event ID 4648 in the Event Viewer that says “A logon was attempted using explicit credentials”. This is triggered when a process tries to log into an account by providing credentials ...