ketshash v1.5 releases: detecting suspicious privileged NTLM connections
Ketshash A little tool for detecting suspicious privileged NTLM connections, in particular, Pass-The-Hash attack, based on event viewer logs. The tool was published as part of the “Pass-The-Hash detection” research...
