Detect NTLM Hash Reuse Across Multiple Hosts

Michael Fajkus@MilesDyson

•updated Jul 31, 2025•28•1•178

Detects suspicious reuse of NTLM authentication hashes by the same user account across multiple hosts within a short time window. This behavior may indicate lateral movement techniques such as pass-the-hash attacks or credential replay.