Detect NTLMv1 Authentications
This query detects NTLM v1 authentications using Falcon ITP telemetry.
CQL · Falcon Next-Gen SIEMCopy query
#event.dataset="falcon.identity"
| network.protocol="ntlm_v1"
| groupBy([SourceAccountUserName, host.hostname, TargetServerHostName])detect_ntlmv1_authentications.yml
ByteRay GmbH
Hunting
Identity
Identity
2025-08-26
2026-01-17
