medium
advisory
Pass the Hash Lateral Movement Detection
This detection identifies Pass the Hash (PtH) activity via Windows Security Event Logs by monitoring for specific logon types and processes associated with NTLM authentication.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Sources
- 4 public sources
- Freshness
- Revision 1Nov 11, 07:32 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
Pass the Hash is an attack technique used to move laterally inside a network. The successful use of PtH for lateral movement between workstations triggers Windows Security Event ID 4624.
Detection Logic
The detection monitors for Event ID 4624 with specific logon types and processes.
- Logons where LogonType is 3, LogonProcessName is 'NtLmSsp', and KeyLength is 0 (excluding 'ANONYMOUS LOGON').
- Logons where LogonType is 9 and LogonProcessName is 'seclogo'.
Detection coverage 1
Detect Pass the Hash Activity via Logon Events
mediumDetects the attack technique pass the hash which is used to move laterally inside the network.
sigma
tactics: lateral-movement
techniques: T1550.002
sources: windows, security
Detection queries are available on the platform. Get full rules →