Windows Search URI NTLM Credential Exposure Activity

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•2

This rule detects suspicious NTLM network or remote interactive logon activity. It specifically looks for multiple distinct accounts logging in from the same device and remote IP address within a one-hour window, using NTLM authentication via NtLmSsp or Seclogon processes. This pattern can indicate credential stuffing, NTLM relay attacks, or other forms of credential misuse.