Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

CVE-2024-38200 NTLM Exposure Detection

Steven Lim@KQLWizard

•updated Jul 1, 2025•2•0•34

KQL Query from file: CVE-2024-38200 NTLM Exposure Detection

Microsoft Sentinel (KQL)

Tags

T1003 - OS Credential Dumping T1203 - Exploitation for Client Execution T1021 - Remote Services TA0006 - Credential Access TA0002 - Execution TA0008 - Lateral Movement T1550.003 - Pass the Ticket T1557.001 - LLMNR/NBT-NS Poisoning and SMB Relay T1097 - Pass the Ticket T1021.002 - SMB/Windows Admin Shares T1496.003 - SMS Pumping T1590.005 - IP Addresses T1595.001 - Scanning IP Blocks T1190 - Exploit Public-Facing Application TA0005 - Defense Evasion TA0009 - Collection TA0040 - Impact TA0043 - Reconnaissance TA0001 - Initial Access Credential Access Network Connection Outbound Exploit Attempt Windows Windows Ntlm Auth Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?