Pass-the-Hash: NTLM Logon Type 3 with Mismatched Workstation

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

Detects NTLM network logons (LogonType 3) where the workstation name does not match the target computer name and is not a machine account. This pattern is commonly associated with lateral movement techniques such as Pass-the-Hash or other credential relay attacks, where an adversary authenticates to a remote system using compromised credentials.