Pass-the-Hash Lateral Movement via Impacket, NetExec and Evil-WinRM with NTLM
Detects potential pass-the-hash (PtH) attacks via command-line execution of offensive tooling (such as Impacket, CrackMapExec, NetExec, Evil-WinRM) specifying NT hashes, as well as remote NTLM network logons from non-standard workstation names characteristic of Linux-based attacker tools spreading across multiple endpoints.
Microsoft Sentinel (KQL)
