Pass-the-Hash/Pass-the-Ticket via multi-host NTLM/RC4-Kerberos reuse without interactive logon
Detects pass-the-hash and pass-the-ticket lateral authentication using NTLM/Kerberos-ticket reuse across multiple hosts without a corresponding interactive logon, excluding known NTLM-by-design service accounts.
Microsoft Sentinel (KQL)
