NTLMv1 Logon Between Client and Server

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects the reporting of NTLMv1 being used between a client and server. NTLMv1 is insecure as the underlying encryption algorithms can be brute-forced by modern hardware.