Pass-the-Hash: NTLM Network Logon Across Multiple Hosts in Seconds
Detects anomalous NTLM network logons (Logon Type 3) where the same user account authenticates to multiple distinct hosts within a short time window. This behavior is correlated with NTLM validation (4776) events to identify potential Pass-the-Hash activity used for lateral movement.
Microsoft Sentinel (KQL)
