Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Custom Detection for CVE-2024-38200 NTLMv2 Hash Exposure

Steven Lim@KQLWizard

•updated Jul 1, 2025•3•0•51

KQL Query

Microsoft Sentinel (KQL)

Tags

T1204 - User Execution T1204.002 - Malicious File T1071 - Application Layer Protocol T1071.001 - Web Protocols TA0002 - Execution TA0011 - Command and Control S0174 - Responder T1557.001 - LLMNR/NBT-NS Poisoning and SMB Relay T1171 - LLMNR/NBT-NS Poisoning and Relay M1015 - Active Directory Configuration T1480.001 - Environmental Keying T1480 - Execution Guardrails C0036 - Pikabot Distribution February 2024 C0045 - ShadowRay C0048 - Operation MidnightEclipse T1137.002 - Office Test T1137 - Office Application Startup T1137.001 - Office Template Macros TA0006 - Credential Access TA0009 - Collection TA0005 - Defense Evasion TA0003 - Persistence Network Connection HTTP Request Email Attachment Downloaded Windows Office 365 M365 Unified Audit Logkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?