4648 — Logon using explicit credentials

A set of credentials different from the current session was used (e.g. runas or connecting as another user). It's a common indicator of stolen-credential use and lateral movement; note the target user and destination host.