Get-WinEvent 4776 legacy auth

Get-WinEvent -FilterHashtable @{LogName='Security';ID=4776}

Query NTLM authentication events 4776 (DC) to detect pass-the-hash, brute force, and legacy authentication anomalies.

Run it when you need visibility into domain NTLM authentication: 4776 is generated on the DC for every NTLM credential validation (traffic on port 445 to the DC). It's the source for detecting pass-the-hash — the pattern of the same account authenticating from many different hosts in a short time, or successful NTLM logons from hosts that aren't the usual ones for that account. You also see brute force against NTLM (multiple 4776 failures with code 0xC000006A) and attempts with locked accounts. In domains that still have NTLM active (most of them), it's one of the most cost-effective queries in the Security log.

Don't use it if your environment has already disabled NTLM (strict Restrict NTLM policy): the event isn't generated and the query is useless — good news, it means the legacy surface is closed. In networks with heavy legitimate NTLM traffic (file servers, legacy apps), the volume is high: filter by failures (Status other than 0x0) or by sensitive accounts before alerting. And note: 4776 doesn't include the source IP in all Windows versions (the Workstation field is sometimes the only source data) — for host correlation, cross-reference with 4624/4625 from the same period.