NTLM Logon Event Detected

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•20

Detects logons using NTLM authentication, which can indicate the presence of legacy systems or be leveraged by attackers for lateral movement or credential access. Event ID 8002 specifically indicates an NTLM authentication event.