Pass-the-Hash: NTLM logons to multiple hosts in rapid succession

Ibrahim Saud@tektrix

•updated 16 days ago•0•0•0

Detects a single user account performing NTLM network logons (LogonType 3) to 3 or more distinct hosts within a short time period. This pattern is commonly associated with lateral movement techniques such as Pass-the-Hash, where an attacker uses compromised credentials to spread across a network.