Detects potentially suspicious explicit credential logon events (Windows Event ID 4648) on the local host where a user attempts to log on using explicit credentials for a different target account. The rule triggers when: EventID 4648 is observed; the domain context is local to the host (TargetServerName/TargetInfo indicating localhost and IPAddress 127.0.0.1/::1); the SubjectUserName is not a machine account (does not end with $); the Source process is not a typical system process or located under Program Files paths (filtered out if ProcessName starts with System32/SysWOW64/WinSxS or Program Files directories); and the SubjectUserName differs from TargetUserName (not the same user). The detection requires all selection criteria to be true while none of the exclusion filters apply. This combination is intended to catch cases where an attacker with credentials for one account attempts to authenticate as another account locally, which could indicate credential abuse or privilege escalation. False positives can arise from legitimate RunAs scenarios using non-standard paths or administrative scripts that explicitly supply credentials. The rule is labeled experimental, with regression/test data and references to event 4648 and related tooling.