skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-pass-the-hash-attacks

Detect Pass-the-Hash attacks by analyzing NTLM authentication patterns in Windows event logs.

954|172|Updated Mar 13, 2026
Search Tags:#threat hunting#lateral movement#pass-the-hash#siem#mitre attack#NTLM#t1550
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-pass-the-hash-attacks
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-pass-the-hash-attacks
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/detecting-pass-the-hash-attacks
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-pass-the-hash-attacks

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Pass-the-Hash attacks let adversaries move laterally using stolen NTLM hashes, and they are easy to miss when NTLM auditing is incomplete or Kerberos-only assumptions hide the activity. This Skill gives threat hunters a structured methodology, detection gaps checklist, and validation steps to surface PtH activity in SIEM and EDR telemetry.

Core Features & Use Cases

  • NTLM anomaly detection: Identify Security EID 4624 Type 3 logons with NTLM where Kerberos is expected, using LogonGuid and authentication package fields.
  • Detection gap analysis: Verify NTLM auditing and DC EID 4776 logging are enabled, and account for local-account (RID 500) logons that bypass DC logs.
  • Evasion awareness: Covers over-pass-the-hash, Impacket artifacts, and false-positive tuning for scanners and scheduled tasks.
  • Use Case: During a purple team exercise, run Atomic Red Team T1550.002 (Mimikatz sekurlsa::pth) and confirm the resulting 4624 Type 3 and 4776 events appear in Splunk or Sentinel within the search window.

Quick Start

Hunt for Pass-the-Hash activity on our Windows fleet by finding Type 3 NTLM logons on hosts that normally authenticate with Kerberos.

Frequently Asked Questions about detecting-pass-the-hash-attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect Pass-the-Hash attacks in Windows event logs?▼

Look for Security EID 4624 Type 3 logons where Authentication Package is NTLM and Logon Process is NtLmSsp on hosts that normally use Kerberos. A LogonGuid of all zeros confirms no Kerberos TGT was requested, which reliably separates NTLM from Kerberos logons.

What tools are needed for Pass-the-Hash threat hunting?▼

You need an EDR platform such as CrowdStrike, Microsoft Defender for Endpoint, or SentinelOne, plus a SIEM like Splunk, Elastic, or Sentinel. Sysmon and Windows Security Event Log forwarding provide the underlying telemetry.

Why does Pass-the-Hash detection miss local account logons?▼

Lateral movement with a local admin hash (RID 500) only logs on the destination host, not the domain controller. Hunt for 4624 Type 3 events where TargetUserName is a local account and LogonGuid is all zeros.

Can attackers evade NTLM-based Pass-the-Hash detection?▼

Yes. Over-pass-the-hash converts the stolen hash into a Kerberos ticket, so activity appears as EID 4768/4769 and defeats NTLM-only rules. Detection must also cover Kerberos ticket anomalies, not just NTLM logons.

How do I validate that my Pass-the-Hash detection rule works?▼

Run Atomic Red Team test T1550.002 using Mimikatz sekurlsa::pth or Impacket psexec.py with hashes from a test host. Confirm the resulting 4624 Type 3 and 4776 events arrive in the SIEM within the search window.

What causes false positives in NTLM Type 3 logon detection?▼

Scheduled tasks, vulnerability scanners like Nessus and Qualys, and clustered applications generate legitimate NTLM Type 3 logons. Baseline service accounts and exclude known scanner source IPs rather than account names.

Related Skills

Explore More Software Engineering Skills→
OpenTideHQOpenTideHQ
4

windows-event-logs

Document Windows-native telemetry sources and audit policy prerequisites for detection engineering.

Official
Advanced
Prohao42Prohao42
120

linux-lateral-movement

Automate lateral movement across Linux hosts using SSH agent hijacking and credential harvesting.

Community
Advanced
riparinoriparino
1

defensive-threat-intelligence

Enrich and correlate threat intel data to surface actionable indicators for SOC operations.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

pass-the-hash

Authenticate to Active Directory services using stolen NTLM hashes, AES keys, or Kerberos tickets.

Official
Advanced