Windows Security Event Pass-the-Hash via 4624 LogonType 3/9 (NtLmSsp, seclogo)

Flags Windows 4624 successful logons consistent with Pass-the-Hash activity using NtLmSsp or seclogo.

FreeUnreviewedSigmamediumv1

windows-security-event-pass-the-hash-via-4624-logontype-3-9-ntlmssp-seclogo-8eef149c

title: Windows Security Event Pass-the-Hash via 4624 LogonType 3/9 (NtLmSsp, seclogo)
id: 78c75ec7-f524-4449-91e2-71a5c2161b47
status: stable
description: This rule identifies potential Pass-the-Hash lateral movement by matching Windows Security Event ID 4624 with logon types commonly associated with authentication flows used during lateral movement. It flags successful authentication events where the logon process name aligns with NtLmSsp or seclogo, while excluding cases where the target user is anonymous. Telemetry relies on Windows Security logs containing Event ID 4624 fields for LogonType, LogonProcessName, SubjectUserSid, and TargetUserName.
references:
  - https://github.com/iadgov/Event-Forwarding-Guidance/tree/master/Events
  - https://web.archive.org/web/20170909091934/https://blog.binarydefense.com/reliably-detecting-pass-the-hash-through-event-log-analysis
  - https://blog.stealthbits.com/how-to-detect-pass-the-hash-attacks/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_pass_the_hash_2.yml
author: Dave Kennedy, Jeff Warren (method) / David Vassallo (rule), Huntrule Team
date: 2019-06-14
modified: 2022-10-05
tags:
  - attack.lateral-movement
  - attack.t1550.002
logsource:
  product: windows
  service: security
  definition: The successful use of PtH for lateral movement between workstations would trigger event ID 4624
detection:
  selection_logon3:
    EventID: 4624
    SubjectUserSid: S-1-0-0
    LogonType: 3
    LogonProcessName: NtLmSsp
    KeyLength: 0
  selection_logon9:
    EventID: 4624
    LogonType: 9
    LogonProcessName: seclogo
  filter:
    TargetUserName: ANONYMOUS LOGON
  condition: 1 of selection_* and not filter
falsepositives:
  - Administrator activity
level: medium
license: DRL-1.1
related:
  - id: 8eef149c-bd26-49f2-9e5a-9b00e3af499b
    type: derived

What it detects

This rule identifies potential Pass-the-Hash lateral movement by matching Windows Security Event ID 4624 with logon types commonly associated with authentication flows used during lateral movement. It flags successful authentication events where the logon process name aligns with NtLmSsp or seclogo, while excluding cases where the target user is anonymous. Telemetry relies on Windows Security logs containing Event ID 4624 fields for LogonType, LogonProcessName, SubjectUserSid, and TargetUserName.

Known false positives

Administrator activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.