Detect Activity Related to Pass the Hash Attacks

SPLUNK detection rule by Bhavin Patel, Patrick Bareiss, Splunk · Apache-2.0

This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts at using the Pass-the-Hash technique. This search is DEPRECATED as it is possible for event code 4624 to generate a high level of noise, as legitimate logon events may also trigger this event code. This can be especially true in environments with high levels of user activity, such as those with many concurrent logons or frequent logon attempts.

name: Detect Activity Related to Pass the Hash Attacks
id: f5939373-8054-40ad-8c64-cec478a22a4b
version: 10
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Patrick Bareiss, Splunk
status: removed
type: Hunting
description: This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts at using the Pass-the-Hash technique. This search is DEPRECATED as it is possible for event code 4624 to generate a high level of noise, as legitimate logon events may also trigger this event code. This can be especially true in environments with high levels of user activity, such as those with many concurrent logons or frequent logon attempts.
data_source:
    - Windows Event Log Security 4624
search: '`wineventlog_security` EventCode=4624 (Logon_Type=3 Logon_Process=NtLmSsp NOT AccountName="ANONYMOUS LOGON") OR (Logon_Type=9 Logon_Process=seclogo) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by EventCode, Logon_Type, WorkstationName, user, dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_activity_related_to_pass_the_hash_attacks_filter`'
how_to_implement: To successfully implement this search, you must ingest your Windows Security Event logs and leverage the latest TA for Windows.
known_false_positives: Legitimate logon activity by authorized NTLM systems may be detected by this search. Please investigate as appropriate.
references: []
tags:
    analytic_story:
        - Active Directory Lateral Movement
        - BlackSuit Ransomware
    asset_type: Endpoint
    mitre_attack_id:
        - T1550.002
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: access
tests:
    - name: True Positive Test
      attack_data:
          - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/atomic_red_team/windows-security.log
            source: WinEventLog:Security
            sourcetype: WinEventLog
deprecation_info:
    reason: Detection deprecated as it no longer effectively identifies the intended malicious activity
    removed_in_version: 5.2.0
    replacement_content: []

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

4f7b4b1e-2135-4bd8-9aac-2f5ce798bef8

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion