Techniques
Sample rules
Successful Overpass the Hash Attempt
- source: sigma
- technicques:
- t1550
- t1550.002
Description
Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz’s sekurlsa::pth module.
Detection logic
condition: selection
selection:
AuthenticationPackageName: Negotiate
EventID: 4624
LogonProcessName: seclogo
LogonType: 9