DETECTION OVERVIEW
Risk Factors
NTLMv1 is a challenge-response authentication protocol for authenticating Windows systems when Kerberos is unavailable. A skilled attacker can easily intercept NTLM hashes and crack passwords offline. A successful exploit of NTLMv1 authentication can also enable an attacker to launch machine-in-the-middle (MITM) attacks or take complete control of a domain.
Kill Chain
Risk Score
—
Restrict or disable NTLMv1 authentication and enable Kerberos for authentication