SMB NTLM Auth to Admin Share (Possible Pass-the-Hash)

Ankit Mehta@Secvyn

•updated 6 days ago•0•0•0

Detects NTLM authentication attempts targeting administrative network shares (ADMIN$ or C$) over the SMB protocol. This behavior is a common indicator of lateral movement techniques such as Pass-the-Hash, where an adversary uses captured NTLM hashes to authenticate to remote systems.