{"id":"98c3bcf1-56f2-49dc-9d8d-c66cf190238b","title":"NTLM Logon","description":"Detects logons using NTLM, which could be caused by a legacy source or attackers","author":"Florian Roth (Nextron Systems)","status":"test","level":"low","date":"2018-06-08","modified":"2024-07-22","tags":["attack.lateral-movement","attack.t1550.002"],"technique_ids":["T1550.002"],"logsource":{"product":"windows","service":"ntlm","definition":"Requires events from Microsoft-Windows-NTLM/Operational"},"falsepositives":["Legacy hosts"],"references":["https://twitter.com/JohnLaTwC/status/1004895028995477505"],"source_path":"rules/windows/builtin/ntlm/win_susp_ntlm_auth.yml","source_sha256":"69a61bde5ec22bd3cc5888dab2974d989d33e240738830470e055660b4c867c3","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/ntlm/win_susp_ntlm_auth.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: NTLM Logon\nid: 98c3bcf1-56f2-49dc-9d8d-c66cf190238b\nstatus: test\ndescription: Detects logons using NTLM, which could be caused by a legacy source or attackers\nreferences:\n    - https://twitter.com/JohnLaTwC/status/1004895028995477505\nauthor: Florian Roth (Nextron Systems)\ndate: 2018-06-08\nmodified: 2024-07-22\ntags:\n    - attack.lateral-movement\n    - attack.t1550.002\nlogsource:\n    product: windows\n    service: ntlm\n    definition: Requires events from Microsoft-Windows-NTLM/Operational\ndetection:\n    selection:\n        EventID: 8002\n    condition: selection\nfalsepositives:\n    - Legacy hosts\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1550.002","id":"T1550.002","name":"Pass the Hash","page":"techniques/enterprise/T1550.002/"}],"data_path":"data/detection-rules/98c3bcf1-56f2-49dc-9d8d-c66cf190238b.json","kind":"sigma"}