Windows Successful Logon Type 9 (NewCredentials) Matching Overpass-the-Hash

ATT&CK techniques

Defense Evasion → Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1550.002Pass the Hash
Cred Access
Discovery
Lateral Movement
- T1550.002Pass the Hash
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies successful Windows logons (EventID 4624) with LogonType 9 (NewCredentials) when the logon process is seclogo and the authentication package is Negotiate. Such sessions can indicate credential abuse consistent with Overpass-the-Hash techniques, where attackers obtain access by using alternate credentials rather than an interactive logon. It relies on Windows Security auditing telemetry for successful logon events and the specific logon/session attributes.

Reporting behind it

Related detections6 linkedT1550.002 — drag to rearrange

Suspicious Registry Modification Disabling RestrictedAdmin Mode (via process_creation)

Suspicious Lateral Movement via Invoke-WMIExec or Invoke-SMBExec (via ps_script)

Windows LsaSrv Events Indicating NTLMv1 Logon Between Client and Server

Windows Pass-the-Hash Activity via Security Event 4624 (LogonType 3 or 9)

Windows NTLM authentication events (Event ID 8002)

Windows Security: Detects RULER workstation using NTLM and login events (Event IDs 4776, 4624/4625)

Windows Successful Logon Type 9 (NewCredentials) Matching Overpass-the-Hash

Pivot detection · T1550.002 · 6 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-successful-logon-type-9-newcredentials-via-negotiate-and-seclogo-192a0330

title: Windows Successful Logon Type 9 (NewCredentials) Matching Overpass-the-Hash
id: 231e0fdb-8fdd-48b1-8c0b-adbe8daa833d
status: test
description: This rule identifies successful Windows logons (EventID 4624) with LogonType 9 (NewCredentials) when the logon process is seclogo and the authentication package is Negotiate. Such sessions can indicate credential abuse consistent with Overpass-the-Hash techniques, where attackers obtain access by using alternate credentials rather than an interactive logon. It relies on Windows Security auditing telemetry for successful logon events and the specific logon/session attributes.
references:
  - https://web.archive.org/web/20220419045003/https://cyberwardog.blogspot.com/2017/04/chronicles-of-threat-hunter-hunting-for.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_overpass_the_hash.yml
author: Roberto Rodriguez (source), Dominik Schaudel (rule), Huntrule Team
date: 2018-02-12
modified: 2021-11-27
tags:
  - attack.lateral-movement
  - attack.s0002
  - attack.t1550.002
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 9
    LogonProcessName: seclogo
    AuthenticationPackageName: Negotiate
  condition: selection
falsepositives:
  - Runas command-line tool using /netonly parameter
level: high
license: DRL-1.1
related:
  - id: 192a0330-c20b-4356-90b6-7b7049ae0b87
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL