<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detecting Pass-the-Hash Attacks

## Windows Event IDs

| Event ID | Source | Relevance |
|---|---|---|
| 4624 | Security | Successful logon — check LogonType 3 + NTLM |
| 4625 | Security | Failed logon — brute force detection |
| 4648 | Security | Explicit credential logon |
| 4672 | Security | Special privileges assigned — admin logon |
| 10 | Sysmon | Process access — LSASS memory reads |
| 1 | Sysmon | Process creation — credential tool execution |

## Key Fields in EID 4624

| Field | PtH Indicator |
|---|---|
| LogonType | 3 (Network) for remote PtH |
| AuthenticationPackageName | NTLM (not Kerberos) |
| LmPackageName | NTLM V1 or V2 |
| WorkstationName | Source host — compare against known admin hosts |
| IpAddress | Source IP — cross-reference with asset inventory |
| TargetUserName | Account used — check if privileged |

## Agent Script

```bash
# Analyze exported security logs
node agent.js analyze security_events.json

# Check NTLM restriction policies
node agent.js check-policy

# Generate custom Sigma rule
node agent.js generate-rule --source-filter "ADMIN,JUMP,PAW"

# Scan Sysmon logs for LSASS access
node agent.js scan-lsass sysmon_export.json
```
