huntrule

Windows NTLM authentication events (Event ID 8002)

Alerts on Windows NTLM authentication occurrences based on Event ID 8002 from Microsoft-Windows-NTLM/Operational.

FreeReviewedSigma · Low · v2
Product
windows
Service
ntlm
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2018-06-08
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion → Lateral Movement

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags occurrences of NTLM authentication on Windows by matching Microsoft-Windows-NTLM/Operational events with Event ID 8002. NTLM logons can be triggered by legacy systems and may also be used by attackers to authenticate laterally within a network. It relies on Windows NTLM operational telemetry that records NTLM-related authentication activity.

Reporting behind it

Related detections6 linkedT1550.002 — drag to rearrange
Suspicious Registry Modification Disabling RestrictedAdmin Mode (via process_creation)
Suspicious Lateral Movement via Invoke-WMIExec or Invoke-SMBExec (via ps_script)
Windows LsaSrv Events Indicating NTLMv1 Logon Between Client and Server
Windows Pass-the-Hash Activity via Security Event 4624 (LogonType 3 or 9)
Windows Successful Logon Type 9 (NewCredentials) Matching Overpass-the-Hash
Windows Security: Detects RULER workstation using NTLM and login events (Event IDs 4776, 4624/4625)
Windows NTLM authentication events (Event ID 8002)
Pivot detection · T1550.002 · 6 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.