Pass-the-Hash - NTLM v1 Lateral Movement Detected

Ankit Mehta@Secvyn

•updated Jun 29, 2026•2•0•1

Detects successful NTLMv1 logon events (Event ID 4624) where the logon type is 3 (Network). NTLMv1 is a legacy and insecure authentication protocol. Its use in a modern environment, particularly for network logons, is often associated with pass-the-hash attacks or legacy compatibility issues that attackers may exploit.