DCOM Lateral Movement - NTLM Network Logon with Elevated Token (Event 4624)
This rule detects successful network logons (LogonType 3) using NTLM (NTLMv1 or NTLMv2) where the authentication results in an elevated token and the logon originates from a different workstation than the target computer. This combination of factors can indicate lateral movement attempts, especially when an adversary has obtained NTLM hashes (e.g., via Pass-the-Hash or NTLM relay attacks) and is attempting to authenticate to other systems on the network. The rule excludes machine accounts and anonymous logons, as well as loopback authentications, to reduce noise.
Microsoft Sentinel (KQL)
