NTLM Logon (98c3bcf1-56f2-49dc-9d8d-c66cf190238b)

Detects logons using NTLM, which could be caused by a legacy source or attackers

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Pass the Hash - T1550.002 (e624264c-033a-424d-9fd7-fc9c3bbdb03e)	Attack Pattern	NTLM Logon (98c3bcf1-56f2-49dc-9d8d-c66cf190238b)	Sigma-Rules	1
Use Alternate Authentication Material - T1550 (51a14c76-dd3b-440b-9c20-2bf91d25a814)	Attack Pattern	Pass the Hash - T1550.002 (e624264c-033a-424d-9fd7-fc9c3bbdb03e)	Attack Pattern	2