Alternate Authentication Material Used for Lateral Access

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects potential lateral movement attempts using alternate authentication material, specifically NTLMSSP, over SMB (port 445). It triggers an alert if five or more NTLMSSP authentications are observed from a single source IP address to the home network within a 30-second window. This behavior can indicate an attacker attempting to authenticate to multiple systems using stolen credentials or hashes.