T1550

Use Alternate Authentication Material

Defense Evasion Lateral Movement Last updated:

Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. Authentication processes generally require a valid identity (e.g., username) along with one or more authentication factors (e.g., password, pin, physical smart card, token generator, etc.). Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s). By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors. Sub-techniques include Application Access Token abuse (T1550.001), Pass the Hash (T1550.002), Pass the Ticket (T1550.003), and Web Session Cookie reuse (T1550.004).

What is T1550 Use Alternate Authentication Material?

Use Alternate Authentication Material (T1550) maps to the Defense Evasion and Lateral Movement tactics — the adversary is trying to avoid being detected in MITRE ATT&CK.

This page provides production-ready detection logic for Use Alternate Authentication Material, covering the data sources and telemetry it touches: Windows Security Event Log, Authentication: Authentication, Logon Session: Logon Session Creation, Active Directory: Active Directory Object Access. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Defense Evasion Lateral Movement
Technique
T1550 Use Alternate Authentication Material
Canonical reference
https://attack.mitre.org/techniques/T1550/
Microsoft Sentinel / Defender
kusto 
// T1550 — Use Alternate Authentication Material
// Detects Pass-the-Hash (LogonType 9 and NTLM network logons), Pass-the-Ticket (RC4 Kerberos downgrade),
// and NTLM hash override attempts using Windows Security Event logs
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID in (4624, 4769, 4776)
// Pass-the-Hash: LogonType 9 (NewCredentials) — definitive mimikatz sekurlsa::pth artifact
| extend PTH_Type9 = iff(
    EventID == 4624 and LogonType == 9,
    1, 0)
// Pass-the-Hash: NTLM network logon from a remote host (not a machine account)
| extend PTH_NTLM = iff(
    EventID == 4624
    and LogonType == 3
    and AuthenticationPackageName =~ "NTLM"
    and TargetUserName !endswith "$"
    and IpAddress !in ("-", "::1", "127.0.0.1", ""),
    1, 0)
// Pass-the-Ticket: RC4-HMAC encryption (0x17) on Kerberos service ticket — golden/silver ticket indicator
| extend PTT_RC4 = iff(
    EventID == 4769
    and TicketEncryptionType =~ "0x17"
    and Status =~ "0x0",
    1, 0)
// Overpass-the-Hash / NTLM relay: NTLM credential validation failures on domain controllers
| extend NTLM_HashFail = iff(
    EventID == 4776
    and Status !in ("0x0", "", "-"),
    1, 0)
| where PTH_Type9 == 1 or PTH_NTLM == 1 or PTT_RC4 == 1 or NTLM_HashFail == 1
| extend AttackPattern = case(
    PTH_Type9 == 1, "Pass-the-Hash: LogonType 9 NewCredentials (mimikatz sekurlsa::pth)",
    PTH_NTLM == 1, "Pass-the-Hash: NTLM Network Logon from Remote Source",
    PTT_RC4 == 1, "Pass-the-Ticket: RC4-HMAC Kerberos Downgrade (Golden/Silver Ticket)",
    NTLM_HashFail == 1, "NTLM Hash Override / Credential Validation Failure",
    "Alternate Auth Abuse"
)
// Weight LogonType 9 highest — it is the most unambiguous PTH indicator
| extend SuspicionScore = PTH_Type9 * 3 + PTH_NTLM + PTT_RC4 * 2 + NTLM_HashFail
| project TimeGenerated, Computer, EventID, TargetUserName, TargetDomainName,
          LogonType, AuthenticationPackageName, IpAddress, WorkstationName,
          SubjectUserName, SubjectDomainName, LogonGuid,
          AttackPattern, SuspicionScore,
          TicketEncryptionType, TicketOptions, Status
| sort by SuspicionScore desc, TimeGenerated desc

Detects alternate authentication material abuse using Windows Security Event logs in Microsoft Sentinel. Covers four detection branches: (1) LogonType 9 (NewCredentials) logons — the primary artifact of mimikatz sekurlsa::pth and overpass-the-hash attacks, almost never seen in legitimate activity on non-developer endpoints; (2) NTLM network logons (LogonType 3) from remote IPs targeting non-machine accounts — common Pass-the-Hash lateral movement pattern seen from tools like Impacket wmiexec.py; (3) Kerberos service ticket requests (Event 4769) using RC4-HMAC encryption (0x17) where AES is expected — strong indicator of golden or silver ticket attacks using forged credentials; (4) NTLM credential validation failures (Event 4776) on domain controllers that may indicate hash spraying or relay attempt activity. Note: Event 4776 only appears in DC logs. Uses a weighted SuspicionScore — LogonType 9 events score 3 (highest confidence), PTT/RC4 score 2, NTLM network logons score 1.

high severity medium confidence

Data Sources

Windows Security Event Log Authentication: Authentication Logon Session: Logon Session Creation Active Directory: Active Directory Object Access

Required Tables

SecurityEvent

False Positives

  • runas /netonly command legitimately generates LogonType 9 events for users running applications with alternate network credentials — expected on developer and admin workstations
  • Legacy applications, NAS appliances, and non-domain-joined devices that cannot negotiate Kerberos will generate NTLM network logons (LogonType 3) — expected in mixed or older environments
  • Windows Server 2008 R2 and earlier systems, as well as third-party Kerberos clients (Linux Samba, older Cisco devices), default to RC4-HMAC encryption and will trigger the PTT_RC4 branch without malicious intent
  • Service accounts explicitly configured for NTLM in certain application integrations (SQL Server linked servers, legacy web applications) may generate recurring NTLM network logon events from known source IPs

Sigma rule & cross-platform mapping

The detection logic for Use Alternate Authentication Material (T1550) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1550 Sigma rules on detection.fyi

Platform-specific guides for T1550

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-13 Research depth: deep
References (11)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Pass-the-Hash via Mimikatz sekurlsa::pth (Windows)

    Expected signal: Sysmon Event ID 1: Process Create for mimikatz.exe with parent process context. Security Event ID 4624 with LogonType=9, TargetUserName=testadmin, AuthenticationPackageName=NTLM on the local host — this fires immediately when the new process token is created. If the spawned cmd.exe then accesses a network resource, Security Event ID 4624 LogonType=3 with NTLM auth will appear on the target host. Sysmon Event ID 10 may appear if mimikatz accessed LSASS.

  2. Test 2Pass-the-Hash via Impacket wmiexec.py (Linux attacking Windows)

    Expected signal: On the target Windows host: Security Event ID 4624 with LogonType=3, AuthenticationPackageName=NTLM, IpAddress=<Linux attacker IP>, TargetUserName=testadmin. Security Event ID 4688 (or Sysmon Event ID 1) showing WmiPrvSE.exe spawning cmd.exe for the WMI command execution. No LogonType 9 event — this is a pure NTLM Type 3 network logon, demonstrating the PTH_NTLM detection branch.

  3. Test 3Pass-the-Ticket — Export and Inject Kerberos Ticket via Mimikatz

    Expected signal: Sysmon Event ID 1: Process Create for mimikatz.exe. After ticket injection, subsequent Kerberos service ticket requests from the session may appear in Security Event ID 4769 — if the injected ticket is RC4-encrypted (common with older tickets or those from tools using RC4), TicketEncryptionType=0x17 will appear. Security Event ID 4648 may appear when using the injected ticket to access network resources. klist output shows the injected service ticket.

  4. Test 4Overpass-the-Hash — Convert NTLM Hash to Kerberos TGT via Mimikatz /ptt

    Expected signal: Security Event ID 4624 LogonType=9 on the local host when the new credential token is created. Security Event ID 4768 (Kerberos TGT request) on the domain controller showing the AS-REQ using RC4-HMAC encryption (TicketEncryptionType=0x17) if the domain does not enforce AES-only. Security Event ID 4769 when the TGT is used to request service tickets for SYSVOL/CIFS access. The combination of LogonType 9 followed by Kerberos tickets from that session ties the PTH origin to subsequent Kerberos activity.

Response Playbook

Triage

  1. Confirm LogonType value from the triggering event — LogonType 9 (NewCredentials) is the single most reliable PTH indicator; verify the SubjectUserName context (SYSTEM or a service account spawning a LogonType 9 for a different user is highly anomalous)
  2. For NTLM network logons (LogonType 3), cross-reference the source IpAddress against your CMDB — is this IP assigned to a workstation that should legitimately access the target Computer? Lateral movement via PTH typically shows an unusual source-destination pair
  3. For RC4 Kerberos alerts (Event 4769, TicketEncryptionType=0x17), check whether your domain enforces AES-only Kerberos — run: Get-ADDefaultDomainPasswordPolicy | Select-Object KerberosEncryptionType to confirm expected encryption. RC4 requests in an AES-enforced domain are high-confidence malicious
  4. Check the SubjectUserName and SubjectLogonId of the triggering event against recent process creation events — look for Sysmon Event ID 1 or Security Event ID 4688 showing credential-dumping tools (mimikatz.exe, procdump.exe, wce.exe, secretsdump.py) on the source host within the prior 30 minutes
  5. Review whether the TargetUserName account has a corresponding interactive logon (LogonType 2 or 10) on the source host near the same time — a hash-based logon without a prior interactive session from that host is suspicious
  6. For Pass-the-Ticket, run klist on both the suspected source and target hosts to enumerate cached tickets and identify any tickets with unusual service names, unusually long lifetimes, or tickets issued far outside business hours

Containment

  1. If LogonType 9 PTH confirmed: immediately isolate the source host using EDR network isolation — the machine likely has an implant performing lateral movement, and the attacker still holds valid credentials in memory
  2. Reset the compromised account's password immediately using: Set-ADAccountPassword -Identity targetuser -NewPassword (ConvertTo-SecureString 'NewPass!' -AsPlainText -Force) — this invalidates the current NTLM hash making it unusable for further PTH, and forces re-authentication
  3. For Pass-the-Ticket attacks, reset the krbtgt account password TWICE with a 10-hour interval between resets to invalidate all issued tickets (Golden Ticket mitigation): Reset-ADAccountPassword -Identity krbtgt — coordinate with your AD team as this briefly disrupts Kerberos in the domain
  4. Revoke any active cloud or SaaS access tokens associated with the compromised account by invalidating sessions in your identity provider (Azure AD: Revoke-AzureADUserAllRefreshToken; Okta: Clear all sessions via API)
  5. Block the source IP at the perimeter firewall and on-host Windows Firewall until the compromised endpoint is reimaged — use: netsh advfirewall firewall add rule name="Block PTH Source" dir=in action=block remoteip=SOURCEIP
  6. Audit all systems the compromised account authenticated to during the attack window using: Search-ADAccount -AccountName username combined with Event ID 4624 queries across all endpoints — contain each destination host that may have been accessed

Evidence Collection

  1. Windows Security Event Log from both the source and destination hosts — export Event IDs 4624, 4648, 4768, 4769, 4776 for the attack time window using: wevtutil epl Security C:\evidence\security.evtx /q:"*[System[(EventID=4624 or EventID=4648 or EventID=4769)]]"
  2. Sysmon Event Log from the source host — Event ID 1 (process creation) and Event ID 10 (process access to LSASS) in the 30 minutes before the PTH event indicate credential dumping; export with: wevtutil epl Microsoft-Windows-Sysmon/Operational C:\evidence\sysmon.evtx
  3. LSASS memory dump if credential dumping is suspected — use: procdump.exe -ma lsass.exe lsass.dmp (run from the source host while still isolated) — preserve for forensic analysis of stolen credential material
  4. Kerberos ticket cache from both source and destination hosts: klist /all > C:\evidence\kerberos_tickets.txt — inject time and ticket lifetimes indicate when tickets were forged or stolen
  5. Prefetch files on the source host for evidence of credential dumping tools: dir C:\Windows\Prefetch\MIMIKATZ* C:\Windows\Prefetch\PROCDUMP* C:\Windows\Prefetch\WCE* — prefetch records execution timestamps even if binaries were deleted
  6. Network PCAP of NTLM authentication sequences — if you have network capture capability, the NTLM Type 1/2/3 handshake will show the NetNTLM hash being passed without prior password exchange
  7. Registry export of LSA protection settings: reg export HKLM\SYSTEM\CurrentControlSet\Control\Lsa C:\evidence\lsa.reg — documents whether Credential Guard, Protected Users, or RunAsPPL was active
  8. PowerShell ScriptBlock Logs (Event ID 4104) from the source host if PowerShell-based PTH tools (Invoke-TheHash, Invoke-Mimikatz) were used — check Microsoft-Windows-PowerShell/Operational log

Escalation Criteria

  • ! LogonType 9 events are almost exclusively produced by PTH tools (runas /netonly is the only common legitimate source) — any LogonType 9 on a non-developer, non-admin endpoint should be treated as confirmed compromise and escalated immediately
  • ! RC4 Kerberos ticket requests (TicketEncryptionType=0x17) from a domain that has AES-only enforcement configured — this is technically impossible without a forged ticket and constitutes confirmed Golden Ticket or Silver Ticket attack
  • ! Lateral movement to high-value targets: PTH or PTT events targeting domain controllers, backup servers, certificate authorities, or servers holding sensitive data (HR, finance, HIPAA/PCI-scoped systems) require immediate escalation
  • ! Multiple hosts authenticating with the same account within a short window (10+ hosts in 30 minutes) using NTLM or LogonType 9 — indicates automated lateral movement using a compromised hash (worm-like spread or automated post-exploitation framework)
  • ! Credential dumping activity detected on source host within 1 hour of alternate auth events — confirms full attack chain: dump credentials, pass hash/ticket, move laterally
  • ! Compromised account holds privileged roles (Domain Admin, Enterprise Admin, Schema Admin, Exchange Admin) — alternate auth abuse against privileged accounts may allow complete domain compromise within minutes

Investigation Guide

Forensic Artifacts

  • > Windows Security Event Log: Event ID 4624 (LogonType 9 and NTLM Type 3) — primary detection source, preserved on both source and destination hosts
  • > Windows Security Event Log on DCs: Event ID 4776 (NTLM credential validation), 4768/4769 (Kerberos TGT/ST requests) — only present on domain controllers
  • > Sysmon Event ID 10 (Process Access): LSASS access events from credential dumping tools immediately preceding PTH activity — process names, PIDs, and access masks recorded
  • > Kerberos ticket cache: accessible via klist command — tickets with RC4 encryption, non-standard lifetimes, or unusual service principals indicate forged tickets
  • > LSASS memory: contains NT hashes, Kerberos tickets, and WDigest credentials — artifacts of what was stolen; analyze with Volatility or commercial memory forensics tools
  • > Prefetch files at C:\Windows\Prefetch\: execution timestamps for mimikatz.exe, procdump.exe, wce.exe, sekurlsa.dll — present even after file deletion if prefetch is enabled
  • > Registry key HKLM\SYSTEM\CurrentControlSet\Control\Lsa\LmCompatibilityLevel: documents NTLM version policy — value 5 (NTLMv2 only) limits attack surface but does not prevent PTH
  • > Windows Credential Manager: HKCU\Software\Microsoft\Protected Storage System Provider — may contain cached credentials accessible to attackers with SYSTEM privileges
  • > Network captures: NTLM Type1/2/3 handshake in packet trace will show authentication without password exchange — identifiable by the absence of a corresponding 4776 validation challenge on the DC when using local hashes

Tuning Guidance

Start by establishing a LogonType 9 baseline in your environment. Run the hunting query for LogonType 9 over 30 days and build an allowlist of known legitimate sources — typically developer workstations using runas /netonly for accessing dev/test environments with different credentials, or specific CI/CD pipelines. For NTLM network logons, identify hosts that legitimately rely on NTLM (older application servers, NAS devices, non-domain systems) and suppress alerts from those known source IPs. For the RC4 Kerberos detection, audit your domain encryption policy first — use Get-ADObject -Filter * -SearchBase 'CN=Domain Controller Policy,...' to confirm AES is enforced domain-wide before treating all RC4 tickets as suspicious. In environments that still support RC4 for legacy compatibility, add ServiceName allowlists for devices that cannot use AES (e.g., specific NAS hostnames or printer service principals). For NTLM hash validation failures (Event 4776), consider suppressing repeated failures from a single source if they correspond to a known service account with stale cached credentials — focus on failures that occur alongside successful LogonType 9 or NTLM network logon events from the same source. Enable Credential Guard (Windows 10/Server 2016+) and Protected Users security group membership for privileged accounts — these prevent NTLM hash extraction from LSASS, dramatically reducing PTH opportunities and false-positive baseline NTLM volume. Enable audit policy for 'Logon/Logoff' and 'Kerberos Authentication Service' via GPO to ensure Events 4624, 4768, and 4769 are generated with full detail including encryption types and logon types.

Hunting Queries

Hunts for sustained Pass-the-Hash campaigns by aggregating LogonType 9 events per account over 7 days. A single LogonType 9 may be runas /netonly, but repeated events — especially from multiple source hosts — indicate an attacker reusing a stolen hash across the environment. DurationMinutes helps distinguish point-in-time testing from ongoing campaign activity.

Hunting — KQL
kql 
// Hunt for sustained PTH campaigns: accounts with repeated LogonType 9 events across multiple source hosts
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4624
| where LogonType == 9
| summarize TotalEvents=count(),
            UniqueSourceHosts=dcount(WorkstationName),
            UniqueTargetHosts=dcount(Computer),
            FirstSeen=min(TimeGenerated),
            LastSeen=max(TimeGenerated),
            SampleSources=make_set(WorkstationName, 5)
  by TargetUserName, TargetDomainName
| where TotalEvents >= 3 or UniqueSourceHosts > 1
| extend DurationMinutes = datetime_diff('minute', LastSeen, FirstSeen)
| sort by TotalEvents desc
Hunting — SPL
spl 
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624
| eval logon_type=coalesce('Logon_Type', logon_type)
| eval target_user=coalesce('Target_User_Name', 'Account_Name', "")
| eval workstation=coalesce('Workstation_Name', workstation, "")
| where logon_type="9"
| stats count as TotalEvents,
        dc(host) as UniqueTargetHosts,
        dc(workstation) as UniqueSourceHosts,
        earliest(_time) as FirstSeen,
        latest(_time) as LastSeen,
        values(workstation) as SampleSources
  by target_user
| where TotalEvents >= 3 OR UniqueSourceHosts > 1
| eval DurationMinutes=round((LastSeen - FirstSeen) / 60, 1)
| sort - TotalEvents

Hunts for targeted services in Pass-the-Ticket attacks by identifying which Kerberos service principals are being requested using RC4-HMAC encryption. Silver Ticket attacks forge service-specific tickets — the ServiceName reveals the targeted resource (e.g., cifs/fileserver indicates SMB access, http/webserver indicates web application access, MSSQLSvc indicates database targeting). High request counts from multiple requesters against specific services indicate active silver ticket usage.

Hunting — KQL
kql 
// Hunt for targeted services in Pass-the-Ticket attacks: identify which service names are being requested with RC4 tickets
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4769
| where TicketEncryptionType =~ "0x17"
| where Status =~ "0x0"
| summarize RequestCount=count(),
            UniqueRequesters=dcount(AccountName),
            RequestingHosts=make_set(Computer, 10),
            FirstSeen=min(TimeGenerated),
            LastSeen=max(TimeGenerated)
  by ServiceName, ServiceSid
| order by RequestCount desc
| where RequestCount >= 5 or UniqueRequesters > 3
Hunting — SPL
spl 
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4769
| eval ticket_enc=coalesce('Ticket_Encryption_Type', ticket_enc, "")
| eval service_name=coalesce('Service_Name', service_name, "")
| eval event_status=coalesce(Status, status, "")
| where (ticket_enc="0x17" OR ticket_enc="23")
  AND (event_status="0x0" OR event_status="")
| stats count as RequestCount,
        dc(host) as UniqueRequesters,
        values(host) as RequestingHosts,
        earliest(_time) as FirstSeen,
        latest(_time) as LastSeen
  by service_name
| where RequestCount >= 5 OR UniqueRequesters > 3
| sort - RequestCount

Hunts for sudden NTLM authentication spikes relative to each host's 7-day baseline — PTH tool deployment (Impacket, CrackMapExec, Metasploit psexec) typically generates a burst of NTLM network logons from a single machine targeting multiple hosts. A SpikeRatio >= 5 with RecentCount >= 10 NTLM events in the last hour compared to the per-hour baseline indicates anomalous NTLM activity worth investigating. This pattern is distinct from the main detection query which looks at individual event characteristics rather than temporal volume anomalies.

Hunting — KQL
kql 
// Hunt for NTLM authentication spikes relative to each host's Kerberos baseline — sudden NTLM increase may indicate PTH tool deployment
let BaselineStart = ago(7d);
let BaselineEnd = ago(1h);
let AlertWindow = ago(1h);
let BaselineHours = 168.0;  // 7 days
let BaselineNTLM = SecurityEvent
| where TimeGenerated between (BaselineStart .. BaselineEnd)
| where EventID == 4624 and LogonType == 3 and AuthenticationPackageName =~ "NTLM"
| where TargetUserName !endswith "$"
| summarize BaselineTotal=count() by Computer
| extend HourlyBaseline = BaselineTotal / BaselineHours;
let RecentNTLM = SecurityEvent
| where TimeGenerated > AlertWindow
| where EventID == 4624 and LogonType == 3 and AuthenticationPackageName =~ "NTLM"
| where TargetUserName !endswith "$"
| summarize RecentCount=count(), AffectedAccounts=dcount(TargetUserName) by Computer;
RecentNTLM
| join kind=inner BaselineNTLM on Computer
| extend SpikeRatio = RecentCount * 1.0 / max_of(HourlyBaseline, 0.5)
| where SpikeRatio >= 5.0 and RecentCount >= 10
| project Computer, RecentCount, HourlyBaseline=round(HourlyBaseline, 2), SpikeRatio=round(SpikeRatio, 1), AffectedAccounts
| sort by SpikeRatio desc
Hunting — SPL
spl 
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624
| eval logon_type=coalesce('Logon_Type', logon_type)
| eval auth_package=lower(coalesce('Authentication_Package_Name', 'Authentication_Package', ""))
| eval target_user=coalesce('Target_User_Name', 'Account_Name', "")
| where logon_type="3" AND (auth_package="ntlm" OR auth_package="ntlmssp")
  AND NOT match(target_user, "\\$$")
| eval is_recent=if(_time >= relative_time(now(), "-1h"), 1, 0)
| eval is_baseline=if(_time < relative_time(now(), "-1h") AND _time >= relative_time(now(), "-7d"), 1, 0)
| stats sum(is_recent) as RecentCount,
        sum(is_baseline) as BaselineTotal,
        dc(if(is_recent=1, target_user, null())) as AffectedAccounts
  by host
| eval HourlyBaseline=round(BaselineTotal / 168.0, 2)
| eval SpikeRatio=round(RecentCount / if(HourlyBaseline > 0.5, HourlyBaseline, 0.5), 1)
| where SpikeRatio >= 5 AND RecentCount >= 10
| table host, RecentCount, HourlyBaseline, SpikeRatio, AffectedAccounts
| sort - SpikeRatio

Atomic Red Team Tests

Test 1 Pass-the-Hash via Mimikatz sekurlsa::pth (Windows)
windows

Uses mimikatz sekurlsa::pth to spawn a new process (cmd.exe) authenticated using a known NTLM hash without requiring the plaintext password. This is the canonical PTH attack and generates the definitive LogonType 9 (NewCredentials) Security Event ID 4624. Replace the /ntlm value with an actual NTLM hash obtained from a test account in your lab. The empty LM hash (aad3b435b51404eeaad3b435b51404ee) shown here represents a placeholder — pair it with a real NTLM hash for the test to authenticate against network resources.

Command

powershell 
mimikatz.exe "privilege::debug" "sekurlsa::pth /user:testadmin /domain:TESTLAB /ntlm:8846f7eaee8fb117ad06bdd830b7586c /run:cmd.exe" "exit"

Cleanup

powershell 
taskkill /f /im cmd.exe 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for mimikatz.exe with parent process context. Security Event ID 4624 with LogonType=9, TargetUserName=testadmin, AuthenticationPackageName=NTLM on the local host — this fires immediately when the new process token is created. If the spawned cmd.exe then accesses a network resource, Security Event ID 4624 LogonType=3 with NTLM auth will appear on the target host. Sysmon Event ID 10 may appear if mimikatz accessed LSASS.

Expected Detection

Alert fires on PTH_Type9=1 (SuspicionScore=3). KQL: LogonType == 9 and EventID == 4624. SPL: PTH_Type9=1, SuspicionScore=3. This is the highest-confidence indicator — LogonType 9 outside of developer/admin workstations is nearly always malicious.

Test 2 Pass-the-Hash via Impacket wmiexec.py (Linux attacking Windows)
linux

Uses the Impacket suite's wmiexec.py tool to execute a command on a Windows target using only an NTLM hash, bypassing the need for a plaintext password. This simulates an attacker on a Linux machine using a stolen hash to laterally move into the Windows environment over WMI/DCOM. Impacket is widely used in red team operations and by APT groups. Replace the hash and target IP with your lab environment values.

Command

bash 
python3 /opt/impacket/examples/wmiexec.py -hashes :8846f7eaee8fb117ad06bdd830b7586c TESTLAB/[email protected] "whoami /all"

Expected Telemetry

On the target Windows host: Security Event ID 4624 with LogonType=3, AuthenticationPackageName=NTLM, IpAddress=<Linux attacker IP>, TargetUserName=testadmin. Security Event ID 4688 (or Sysmon Event ID 1) showing WmiPrvSE.exe spawning cmd.exe for the WMI command execution. No LogonType 9 event — this is a pure NTLM Type 3 network logon, demonstrating the PTH_NTLM detection branch.

Expected Detection

Alert fires on PTH_NTLM=1 (SuspicionScore=1). KQL: LogonType == 3, AuthenticationPackageName == 'NTLM', IpAddress matching the Linux source. SPL: PTH_NTLM=1. Cross-reference with network logs to confirm the IpAddress belongs to a Linux system unexpectedly authenticating via NTLM to a Windows host.

Test 3 Pass-the-Ticket — Export and Inject Kerberos Ticket via Mimikatz
windows

Uses mimikatz to first export all current Kerberos tickets from memory to .kirbi files (kerberos::list /export), then injects a specific ticket into the current session (kerberos::ptt). This simulates the pass-the-ticket technique where an attacker steals a TGT or service ticket from a compromised host and reuses it on another. In a real attack, the .kirbi file would be exfiltrated and used from a different machine. The second command assumes a ticket file named after the default mimikatz export format. Run klist after injection to confirm the ticket is loaded.

Command

powershell 
mimikatz.exe "privilege::debug" "kerberos::list /export" "exit"
For /F "tokens=*" %f in ('dir /b *.kirbi') do (mimikatz.exe "kerberos::ptt "%f"" "exit" && break)
klist

Cleanup

powershell 
klist purge
del *.kirbi 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for mimikatz.exe. After ticket injection, subsequent Kerberos service ticket requests from the session may appear in Security Event ID 4769 — if the injected ticket is RC4-encrypted (common with older tickets or those from tools using RC4), TicketEncryptionType=0x17 will appear. Security Event ID 4648 may appear when using the injected ticket to access network resources. klist output shows the injected service ticket.

Expected Detection

If the injected ticket used RC4 encryption: alert fires on PTT_RC4=1 (SuspicionScore=2) when the ticket is presented to access a service. KQL: EventID == 4769, TicketEncryptionType == '0x17'. SPL: PTT_RC4=1. Initial ticket export and injection themselves are not logged directly by Windows — focus detection on the subsequent resource access using the injected ticket.

Test 4 Overpass-the-Hash — Convert NTLM Hash to Kerberos TGT via Mimikatz /ptt
windows

Overpass-the-Hash (also called Pass-the-Key) uses an NTLM hash to request a Kerberos TGT, bridging NTLM credential theft with Kerberos authentication. Unlike pure PTH which stays in NTLM, overpass-the-hash generates Kerberos traffic and can bypass environments that block NTLM. The /ptt flag injects the resulting ticket directly into memory. This technique was popularized by mimikatz and is used by threat actors to gain Kerberos-based access with only an NTLM hash.

Command

powershell 
mimikatz.exe "privilege::debug" "sekurlsa::pth /user:testadmin /domain:TESTLAB.LOCAL /ntlm:8846f7eaee8fb117ad06bdd830b7586c /ptt" "exit"
klist
net use \\dc01.testlab.local\SYSVOL

Cleanup

powershell 
klist purge
net use \\dc01.testlab.local\SYSVOL /delete 2>nul

Expected Telemetry

Security Event ID 4624 LogonType=9 on the local host when the new credential token is created. Security Event ID 4768 (Kerberos TGT request) on the domain controller showing the AS-REQ using RC4-HMAC encryption (TicketEncryptionType=0x17) if the domain does not enforce AES-only. Security Event ID 4769 when the TGT is used to request service tickets for SYSVOL/CIFS access. The combination of LogonType 9 followed by Kerberos tickets from that session ties the PTH origin to subsequent Kerberos activity.

Expected Detection

Alert fires on PTH_Type9=1 (SuspicionScore=3) from the local Security Event ID 4624 LogonType 9. If RC4 TGT is issued: PTT_RC4=1 also fires when the DC issues the TGT (SuspicionScore=2 on DC logs). KQL: EventID==4624 LogonType==9 correlated with EventID==4768 TicketEncryptionType=='0x17' from same time window. SPL: PTH_Type9=1 AND PTT_RC4=1 correlated by timeframe.

Related Detections

Tactic Hubs

TA0005Defense EvasionTA0008Lateral Movement

Sub-techniques (4)

Related Techniques

T1550.001Application Access TokenT1550.002Pass the HashT1550.003Pass the TicketT1550.004Web Session CookieT1003OS Credential DumpingT1003.001LSASS MemoryT1558Steal or Forge Kerberos TicketsT1558.001Golden TicketT1558.003KerberoastingT1021.002SMB/Windows Admin SharesT1021.006Windows Remote ManagementT1134Access Token Manipulation

Same Tactic: Defense Evasion

Popular Detections