Pass-the-Hash: NTLM Network Logon to 3+ Devices as Local Admin

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•1

Detects potential Pass-the-Hash lateral movement where a single account uses NTLM authentication as a local administrator to access three or more distinct devices within a 30-minute window, a pattern often indicative of automated credential propagation.