Pass-the-Hash: Admin NTLM logons across multiple DCs in short window without interactive/Kerberos evidence
This rule detects potential Pass-the-Hash (PtH) lateral movement by identifying administrative accounts performing NTLM network logons across multiple domain controllers within a 15-minute window. To reduce false positives, the rule excludes authentication events where there is concurrent evidence of interactive (Type 2/10) or Kerberos-based authentication on those same hosts, which helps isolate suspicious non-Kerberos administrative activity.
Microsoft Sentinel (KQL)
