Possible PetitPotam Coerce Authentication Attempt – Elevated User Access without Source Workstation
The detection identifies successful NTLM V2 logons (Event ID 4624) that received an elevated token while not having a source workstation name. This combination is uncommon during normal user activity and may indicate authentication coercion techniques such as PetitPotam, NTLM relay activity, or service-to-service authentication originating from an unexpected host.
Microsoft Sentinel (KQL)
