Successful Overpass the Hash Attempt

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•29

Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior, often associated with tools like Mimikatz's sekurlsa::pth module. This indicates an adversary is using stolen password hashes to authenticate to a system.