Windows System: NTLMv1 Logon Reported Between Client and Server (LsaSrv 6038/6039)

Flags LsaSrv events 6038/6039 showing NTLMv1 authentication between client and server on Windows.

FreeUnreviewedSigmamediumv1

windows-system-ntlmv1-logon-reported-between-client-and-server-lsasrv-6038-6039-e9d4ab66

title: "Windows System: NTLMv1 Logon Reported Between Client and Server (LsaSrv 6038/6039)"
id: 46de5af2-18c6-4931-871e-4226b2b26441
status: test
description: This rule flags Windows System events from the LsaSrv provider indicating NTLMv1 is being used for authentication between a client and server. NTLMv1 is weaker than newer authentication methods and can be brute-forced with modern hardware, so its presence may indicate policy weakness or attacker-preferred downgrade behavior. It relies on telemetry that records LsaSrv events 6038 and 6039, reported to the Windows event log.
references:
  - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/22H2/W10_22H2_Pro_20230321_19045.2728/WEPExplorer/LsaSrv.xml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/lsasrv/win_system_lsasrv_ntlmv1.yml
author: Tim Shelton, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-04-26
modified: 2023-06-06
tags:
  - attack.lateral-movement
  - attack.t1550.002
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: LsaSrv
    EventID:
      - 6038
      - 6039
  condition: selection
falsepositives:
  - Environments that use NTLMv1
level: medium
license: DRL-1.1
related:
  - id: e9d4ab66-a532-4ef7-a502-66a9e4a34f5d
    type: derived

What it detects

This rule flags Windows System events from the LsaSrv provider indicating NTLMv1 is being used for authentication between a client and server. NTLMv1 is weaker than newer authentication methods and can be brute-forced with modern hardware, so its presence may indicate policy weakness or attacker-preferred downgrade behavior. It relies on telemetry that records LsaSrv events 6038 and 6039, reported to the Windows event log.

Known false positives

Environments that use NTLMv1

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.