Pass-the-Hash: NTLM Logon Type 3/9 Reused Across Multiple Hosts
This rule detects potential lateral movement by identifying a single user account authenticating to three or more distinct hosts using NTLM via network (LogonType 3) or impersonation (LogonType 9) logons, which is characteristic of credential-based movement across a network.
CQL
