Windows Send NTLM Hash with RPC Test Connection (T1003)

Danny Y@zendannyy

•updated Jun 20, 2026•0•0•2

Hunting rule for Atomic Red Team T1003 test "Send NTLM Hash with RPC Test Connection" (OS Credential Dumping) using command-line and process indicators derived from executor behavior.