The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Logon Activity for Interesting Processes

  • Published on Sep 11, 2026
  • 1 minute(s) read
Prev Next
Skip to main content

Windows "Explicit" logins (EID 4648) are logins to a remote system that are recorded on the originating system. These logons are represented in the UI with a status of "UNKNOWN", as the Windows Explicit logon record does not include an indication of success or failure. Think of a Windows Explicit logon as the OS recording "I can't tell you what happened, but someone on this system tried to log into this other system". What's particularly interesting about these logons is that the process that attempted the login is recorded (PowerShell, cscript, IIS, documents, browsers). To review these logins:

  • Filter on category "unknown" and/or status "unknown"

  • Open the Graph Filter

  • Review the unique "process"

Related articles
  • Logon activity for interesting processes
    Endpoint Security Modules (HX) > Logon Tracker > Endpoint Security Logon Tracker Module User Guide Release 1.2.0 > Common investigative workflows > Hunting for suspicious activity
  • Logon activity for interesting processes
    Endpoint Security Modules (HX) > Logon Tracker > Endpoint Security (HX) Logon Tracker Module User Guide 1.3.x > Common investigative workflows > Hunting for suspicious activity
  • Windows Logon Types
    Endpoint Security Modules (HX) > Logon Tracker > Endpoint Security Logon Tracker Module User Guide Release 1.1.9 > Module Overview > Logon Data Sources