LoFP LoFP / runas command-line tool using /netonly parameter

Techniques

Sample rules

Successful Overpass the Hash Attempt

Description

Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz’s sekurlsa::pth module.

Detection logic

condition: selection
selection:
  AuthenticationPackageName: Negotiate
  EventID: 4624
  LogonProcessName: seclogo
  LogonType: 9