Most Popular Detection 2026 – Pass-the-Hash: NTLM Logons Across Multiple Hosts/Admin Shares
Detects potential lateral movement by identifying NTLM authentication (Logon Type 3) to administrative network shares (ADMIN$, C$, IPC$) or high-frequency access to multiple hosts by the same user, which may indicate credential abuse or lateral movement attempts.
Cortex XDR
