Note:I translated Japanese into English using Google Translate.Thank you, Google. Summary: Check when the ID 4648 occurs. Runas,Overpass-the-Hash,NET USE,Task Scheduler(schtasks),PsExec,WMIC,PowerShell,Remote Desktop(mstsc) If authenticati…