DETECTION OVERVIEW
Risk Factors
NTLMv1 is a challenge-response authentication protocol for authenticating Windows systems when Kerberos is unavailable. NTLMv1 has vulnerabilities that can enable an attacker to collect NTLM hashes or launch machine-in-the-middle (MITM) attacks.
The system might change the risk score for this detection.
Kill Chain
Risk Score
37
N/A
Restrict or disable NTLM authentication and enable Kerberos for authentication