Pass-the-hash: 4624 type 9 seclogo logon plus cmd named-pipe echo on same host

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•1

Correlates a type 9 'seclogo' logon event with a cmd.exe named-pipe echo command (not spawned by services.exe) on the same device within a 30-minute window, which can indicate lateral movement or credential manipulation techniques.