Windows NTLM Logon Event ID 8002

title: Windows NTLM Logon Event ID 8002
id: 01301be9-acf7-4d38-b981-a30e238578f8
status: test
description: This rule flags Windows NTLM authentication activity when the system records Event ID 8002 in the NTLM operational log. NTLM logons can be generated by legacy systems or enabled authentication paths, but they may also be used by attackers to perform authentication for later movement. Detection relies on Microsoft-Windows-NTLM/Operational telemetry, specifically the EventID value.
references:
  - https://twitter.com/JohnLaTwC/status/1004895028995477505
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/ntlm/win_susp_ntlm_auth.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-06-08
modified: 2024-07-22
tags:
  - attack.lateral-movement
  - attack.t1550.002
logsource:
  product: windows
  service: ntlm
  definition: Requires events from Microsoft-Windows-NTLM/Operational
detection:
  selection:
    EventID: 8002
  condition: selection
falsepositives:
  - Legacy hosts
level: low
license: DRL-1.1
related:
  - id: 98c3bcf1-56f2-49dc-9d8d-c66cf190238b
    type: derived