attack.t1550.002

Hacktool Ruler

Apr 28, 2026 · attack.discovery attack.execution attack.collection attack.lateral-movement attack.t1087 attack.t1114 attack.t1059 attack.t1550.002 ·

Share on:

This events that are generated when using the hacktool Ruler by Sensepost

NTLM Logon

Apr 28, 2026 · attack.lateral-movement attack.t1550.002 ·

Share on:

Detects logons using NTLM, which could be caused by a legacy source or attackers

NTLMv1 Logon Between Client and Server

Apr 28, 2026 · attack.lateral-movement attack.t1550.002 ·

Share on:

Detects the reporting of NTLMv1 being used between a client and server. NTLMv1 is insecure as the underlying encryption algorithms can be brute-forced by modern hardware.

Pass the Hash Activity 2

Apr 28, 2026 · attack.lateral-movement attack.t1550.002 ·

Share on:

Detects the attack technique pass the hash which is used to move laterally inside the network

Successful Overpass the Hash Attempt

Apr 28, 2026 · attack.lateral-movement attack.s0002 attack.t1550.002 ·

Share on:

Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module.