Detection rules › By catalog entry

Microsoft-Windows-NTLM

Catalog entry	Rules
Event ID 8001	1
Event ID 8004	6
Event ID 8006	5

Event ID 8001

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

Potential Remote Desktop Connection to Non-Domain Host severity medium T1219,T1219.002

Event ID 8004

6 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

NTLM Brute Force severity medium T1110

Splunk (5)

Windows Multiple NTLM Null Domain Authentications severity medium T1110,T1110.003
Windows Unusual NTLM Authentication Destinations By Source severity low T1110,T1110.003
Windows Unusual NTLM Authentication Destinations By User severity low T1110,T1110.003
Windows Unusual NTLM Authentication Users By Destination severity low T1110,T1110.003
Windows Unusual NTLM Authentication Users By Source severity low T1110,T1110.003

Event ID 8006

5 detection rules reference this catalog entry. View catalog entry.

Splunk (5)

Windows Multiple NTLM Null Domain Authentications severity medium T1110,T1110.003
Windows Unusual NTLM Authentication Destinations By Source severity low T1110,T1110.003
Windows Unusual NTLM Authentication Destinations By User severity low T1110,T1110.003
Windows Unusual NTLM Authentication Users By Destination severity low T1110,T1110.003
Windows Unusual NTLM Authentication Users By Source severity low T1110,T1110.003

Back to all Microsoft-Windows-NTLM catalog entries