Detection rules › By event

Microsoft-Windows-NTLM

Event	Rules
Event ID 8001	1
Event ID 8004	6
Event ID 8006	5

Event ID 8001

1 detection rules reference this event. View event page.

Sigma (1)

Potential Remote Desktop Connection to Non-Domain Host severity medium T1219, T1219.002

Event ID 8004

6 detection rules reference this event. View event page.

Sigma (1)

NTLM Brute Force severity medium T1110

Splunk (5)

Windows Multiple NTLM Null Domain Authentications severity medium T1110, T1110.003
Windows Unusual NTLM Authentication Destinations By Source severity low T1110, T1110.003
Windows Unusual NTLM Authentication Destinations By User severity low T1110, T1110.003
Windows Unusual NTLM Authentication Users By Destination severity low T1110, T1110.003
Windows Unusual NTLM Authentication Users By Source severity low T1110, T1110.003

Event ID 8006

5 detection rules reference this event. View event page.

Splunk (5)

Windows Multiple NTLM Null Domain Authentications severity medium T1110, T1110.003
Windows Unusual NTLM Authentication Destinations By Source severity low T1110, T1110.003
Windows Unusual NTLM Authentication Destinations By User severity low T1110, T1110.003
Windows Unusual NTLM Authentication Users By Destination severity low T1110, T1110.003
Windows Unusual NTLM Authentication Users By Source severity low T1110, T1110.003