Summary
This demonstration explains how ManageEngine's Log360 SIEM solution detects Pass-the-Hash attacks, a credential theft technique where attackers exploit NTLM protocol vulnerabilities to authenticate using stolen password hashes rather than plaintext passwords. The video walks through the attack methodology—from initial compromise through hash extraction using tools like Mimikatz to lateral movement and privilege escalation—and demonstrates Log360's out-of-the-box detection capabilities. The solution provides MITRE ATT&CK-aligned reporting under the Defense Evasion tactic, offering visual analytics and detailed event logging including IP addresses, event IDs, logon types, and process names. Log360's SOAR capabilities enable automated response workflows such as process termination and device/user disabling when Pass-the-Hash activity is detected. The presentation concludes with preventive best practices including mandatory password resets, MFA implementation, least privilege access controls, and security policy auditing.
