KQL_win_pass_the_hash.txt

SecurityEvent | where ((LogonType == "3" and LogonProcessName == "NtLmSsp" and WorkstationName == "%Workstations%" and ComputerName == "%Workstations%" and (EventID == "4624" or EventID == "4625")) and not (AccountName == "ANONYMOUS LOGON"))