win:ntlm
NTLM operational log
Channel: Microsoft-Windows-NTLM/Operational
- Host type
- Windows (workstation, member server, domain controller)
- Techniques
- 0
- Rules listed
- 8
- Events
- 5
Techniques
No ATT&CK analytic names this source.
Rules
Splunk 5
Sigma 3
- NTLM Brute Force by Jerry Shockley '@jsh0x'
- NTLM Logon by Florian Roth (Nextron Systems)
- Potential Remote Desktop Connection to Non-Domain Host by James Pemberton