Most Popular Detection 2026: Pass-the-Hash Lateral Movement via NTLM to Multiple Hosts
Detects anomalous lateral movement behavior where a single user account authenticates via NTLM (LogonType 3, network logon) to three or more distinct hosts within a 30-minute window, without a preceding interactive logon (LogonType 2). This pattern is a strong indicator of an adversary using captured NTLM hashes to move laterally across a Windows environment.
Microsoft Sentinel (KQL)
