ATT&CK T1550.002 - Pass-the-Hash SMB Authentication

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•7

This rule detects SMB authentication attempts that might be indicative of a 'Pass-the-Hash' attack (ATT&CK T1550.002). It specifically looks for NTLMSSP (NT LAN Manager Security Support Provider) traffic on TCP port 445 (SMB) where the NTLM authentication message contains a specific sequence of null bytes, which can be characteristic of a hash being passed instead of a cleartext password.