Pass-the-Hash NTLM SMB Auth with Blank LM Hash - Lateral Movement

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects SMB authentication attempts using NTLM with a blank Lan Manager (LM) hash. This specific pattern is often associated with Pass-the-Hash attacks where tools inject malformed or blank hashes to initiate authentication, a common indicator of lateral movement attempts.