KQL_win_overpass_the_hash.txt

SecurityEvent | where (EventID == "4624" and LogonType == "9" and LogonProcessName == "seclogo" and AuthenticationPackageName == "Negotiate")