NTLM network logon
A network logon (Security 4624, Logon Type 3) authenticated with NTLM rather than Kerberos.
What it detects
A network logon (Security 4624, Logon Type 3) authenticated with NTLM rather than Kerberos. Pass-the-hash replays a stolen NT hash and always authenticates over NTLM, so in a Kerberos-first Active Directory environment an NTLM network logon — especially for a privileged/domain account or against a domain-joined server that should accept Kerberos — is a pass-the-hash / lateral-movement lead. Kept at medium: NTLM network logons also occur legitimately (IP-literal access, non-Kerberos appliances, some local accounts), so this is a lead to correlate, not a verdict.
MITRE ATT&CK mapping
False positives and triage
NTLM is still used legitimately for access by IP address, to non-domain / appliance targets, and by some local accounts. Prioritise: NTLM logons for privileged or domain accounts; many distinct targets from one source (lateral spread); NTLMv1; or an account that normally authenticates with Kerberos suddenly using NTLM. Correlate with DC-side NTLM validation (4776) and the source host. Allow-list known legacy NTLM services by source.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 50%. Source: rules/windows/ntlm_network_logon.yaml, licensed under the Apache License 2.0.
id: windows.credential.ntlm_network_logon
version: 1.0.0
status: stable
severity: medium
confidence: 0.5
platforms: [windows]
mitre_techniques: [T1550.002, T1021.002]
description: |
A network logon (Security 4624, Logon Type 3) authenticated with NTLM rather than
Kerberos. Pass-the-hash replays a stolen NT hash and always authenticates over NTLM, so
in a Kerberos-first Active Directory environment an NTLM network logon — especially for a
privileged/domain account or against a domain-joined server that should accept Kerberos —
is a pass-the-hash / lateral-movement lead. Kept at medium: NTLM network logons also occur
legitimately (IP-literal access, non-Kerberos appliances, some local accounts), so this is
a lead to correlate, not a verdict.
match:
event_action: ntlm_network_logon
false_positive_guidance: |
NTLM is still used legitimately for access by IP address, to non-domain / appliance
targets, and by some local accounts. Prioritise: NTLM logons for privileged or domain
accounts; many distinct targets from one source (lateral spread); NTLMv1; or an account
that normally authenticates with Kerberos suddenly using NTLM. Correlate with DC-side NTLM
validation (4776) and the source host. Allow-list known legacy NTLM services by source.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.