Pass-the-Hash Lateral Movement via NTLM (4624 Type 3/9)

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•2

Detects anomalous lateral movement behavior where a single user account authenticates via NTLM to three or more distinct target hosts within a short time window (10 minutes). This pattern of rapid, broad authentication is a strong indicator of a Pass-the-Hash (PtH) attack.