Windows Pass-the-Hash Activity via Security Event 4624 (LogonType 3 or 9)

Flags Windows 4624 successful logons consistent with Pass-the-Hash activity using NtLmSsp or seclogo.

FreeReviewedSigma · Medium · v2

Product: windows
Service: security
Author: Dave Kennedy, Jeff Warren (method) / David Vassallo (rule) (SigmaHQ), DRL 1.1
Published: 2019-06-14
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion → Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1550.002Pass the Hash
Cred Access
Discovery
Lateral Movement
- T1550.002Pass the Hash
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows logon events consistent with pass-the-hash lateral movement activity by matching Security Event ID 4624 with specific LogonType values. Attackers can use pass-the-hash to authenticate to remote systems without knowing the plaintext password, enabling lateral movement within a network. It relies on Windows Security auditing telemetry (Event ID 4624), including the logon process name and logon type fields.

Reporting behind it

Related detections6 linkedT1550.002 — drag to rearrange

Suspicious Registry Modification Disabling RestrictedAdmin Mode (via process_creation)

Suspicious Lateral Movement via Invoke-WMIExec or Invoke-SMBExec (via ps_script)

Windows LsaSrv Events Indicating NTLMv1 Logon Between Client and Server

Windows NTLM authentication events (Event ID 8002)

Windows Successful Logon Type 9 (NewCredentials) Matching Overpass-the-Hash

Windows Security: Detects RULER workstation using NTLM and login events (Event IDs 4776, 4624/4625)

Windows Pass-the-Hash Activity via Security Event 4624 (LogonType 3 or 9)

Pivot detection · T1550.002 · 6 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-event-pass-the-hash-via-4624-logontype-3-9-ntlmssp-seclogo-8eef149c

title: Windows Pass-the-Hash Activity via Security Event 4624 (LogonType 3 or 9)
id: 78c75ec7-f524-4449-91e2-71a5c2161b47
status: stable
description: This rule identifies Windows logon events consistent with pass-the-hash lateral movement activity by matching Security Event ID 4624 with specific LogonType values. Attackers can use pass-the-hash to authenticate to remote systems without knowing the plaintext password, enabling lateral movement within a network. It relies on Windows Security auditing telemetry (Event ID 4624), including the logon process name and logon type fields.
references:
  - https://github.com/iadgov/Event-Forwarding-Guidance/tree/master/Events
  - https://web.archive.org/web/20170909091934/https://blog.binarydefense.com/reliably-detecting-pass-the-hash-through-event-log-analysis
  - https://blog.stealthbits.com/how-to-detect-pass-the-hash-attacks/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_pass_the_hash_2.yml
author: Dave Kennedy, Jeff Warren (method) / David Vassallo (rule), Huntrule Team
date: 2019-06-14
modified: 2022-10-05
tags:
  - attack.lateral-movement
  - attack.t1550.002
logsource:
  product: windows
  service: security
  definition: The successful use of PtH for lateral movement between workstations would trigger event ID 4624
detection:
  selection_logon3:
    EventID: 4624
    SubjectUserSid: S-1-0-0
    LogonType: 3
    LogonProcessName: NtLmSsp
    KeyLength: 0
  selection_logon9:
    EventID: 4624
    LogonType: 9
    LogonProcessName: seclogo
  filter:
    TargetUserName: ANONYMOUS LOGON
  condition: 1 of selection_* and not filter
falsepositives:
  - Administrator activity
level: medium
license: DRL-1.1
related:
  - id: 8eef149c-bd26-49f2-9e5a-9b00e3af499b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL