Sigma rule: Pass the Hash Activity 2

Rule

Title

Pass the Hash Activity 2

Status

stable

Level

medium

Author

Dave Kennedy, Jeff Warren (method) / David Vassallo (rule)

Date

2019-06-14

Modified

2022-10-05

File

rules/windows/builtin/security/account_management/win_security_pass_the_hash_2.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the attack technique pass the hash which is used to move laterally inside the network

Log source

product

windows

service

security

definition

The successful use of PtH for lateral movement between workstations would trigger event ID 4624

Detection

selection_logon3:
    EventID: 4624
    SubjectUserSid: 'S-1-0-0'
    LogonType: 3
    LogonProcessName: 'NtLmSsp'
    KeyLength: 0
selection_logon9:
    EventID: 4624
    LogonType: 9
    LogonProcessName: 'seclogo'
filter:
    TargetUserName: 'ANONYMOUS LOGON'
condition: 1 of selection_* and not filter

False positives (as the rule lists them)

• Administrator activity

Tags

• attack.lateral-movement
• attack.t1550.002

MITRE ATT&CK ids this rule names

• T1550.002

References

• https://github.com/iadgov/Event-Forwarding-Guidance/tree/master/Events
• https://web.archive.org/web/20170909091934/https://blog.binarydefense.com/reliably-detecting-pass-the-hash-through-event-log-analysis
• https://blog.stealthbits.com/how-to-detect-pass-the-hash-attacks/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/account_management/win_security_pass_the_hash_2.yml