Detect NTLMv1 Authentications (Windows Event Logs)

| windows.EventData.AuthenticationPackageName=NTLM
| windows.EventData.LmPackageName!= "NTLM V2" 
| groupBy([windows.EventData.WorkstationName, user.target.name, windows.EventData.KeyLength])
| rename(field="windows.EventData.WorkstationName", as="Hostname")
| rename(field="user.target.name", as="Username")
| rename(field="windows.EventData.KeyLength", as="KeyLength")
| sort(field=KeyLength,type=number,order=desc)
| case{
  KeyLength = 128
  | SSP := "Yes";
  in(field="KeyLength", values=[0,40,56])
  | SSP := "No"
}
| table([Hostname,Username,KeyLength,SSP])