NTLM

NTLM Event ID 8002: Incoming authentication audit

NTLM server blocked audit: Audit Incoming NTLM Traffic that would be blockedNTLM event 8002 logs incoming NTLM authentication processed by this server, with the calling process and its identity. Maps which servers still accept NTLM.

8002

Event ID: 8002
Channel: Microsoft-Windows-NTLM/Operational
Provider: Microsoft-Windows-NTLM
Log file: Microsoft-Windows-NTLM%4Operational.evtx
Category: NTLM
Default logging: Needs configuration

What event 8002 means

Event 8002 is written on the server that received an NTLM authentication request when incoming NTLM auditing is enabled. Like the other 800x events it is an audit-only record of traffic that would be blocked by the corresponding restriction policy; nothing is blocked.

It identifies the local process that handled the authentication (ProcessName, CallerPID) and the identity and logon session of that calling process (ClientUserName, ClientDomainName, ClientLUID), as labelled in the message. It does not include the source IP; correlate with 4624 on the same host (same time, AuthenticationPackageName NTLM) to get the authenticated account, IpAddress and WorkstationName.

The main use is inventory before restricting NTLM, but it also helps spot NTLM authentication to servers that should only see Kerberos — for example relayed or pass-the-hash logons, which always use NTLM.

When it is logged

Audit policy / configuration

Security Options > Network security: Restrict NTLM: Audit Incoming NTLM Traffic = Enable auditing for domain accounts, or Enable auditing for all accounts.

Only traffic to the computer where the policy is set is logged. Volume can be high on file and web servers; size the NTLM/Operational log accordingly.

Key fields

Field	What it tells you
CallerPID	PID of the server process that handled the authentication; `4` for SMB handled in kernel mode.
ProcessName	Path of the server process (IIS worker, `lsass.exe`, an application service).
ClientLUID	Logon session (LUID) of the calling process, shown as "Calling process LUID" in the message.
ClientUserName	User identity of the calling process, shown as "Calling process user identity".
ClientDomainName	Domain identity of the calling process.
MechanismOID	Negotiation mechanism OID, often `(NULL)`.

Common benign sources

Clients connecting by IP address or through DNS aliases without matching SPNs.
Non-domain devices and legacy applications authenticating with local or domain accounts.
Monitoring and backup products configured for NTLM.

What attackers do that produces it

NTLM relay (for example from coerced authentication) landing on this server.
Pass-the-hash lateral movement, which necessarily uses NTLM and therefore shows up as incoming NTLM on the target.

Investigation tips

Build a list of processes accepting NTLM per server, then use the matching 4624 events to list the accounts involved; privileged accounts using NTLM to sensitive servers deserve review.
Correlate with 4624 (LogonType 3, AuthenticationPackageName NTLM) at the same time to get the source IP and workstation.
On domain controllers, match with 8004 and 4776 for the same account.

MITRE ATT&CK techniques

Technique	Tactics
T1550.002 Use Alternate Authentication Material: Pass the Hash	Lateral Movement
T1557.001 Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay	Credential Access, Collection

MITRE ATT&CK v19.2. Technique and tactic names are MITRE's.

Sigma rules for this event

1 SigmaHQ detection rules (release r2026-07-01) target this event.

Low · 1

LowNTLM LogonRule by Florian Roth (Nextron Systems), SigmaHQ, DRL 1.1

Rules by their named authors, published by SigmaHQ under the Detection Rule License (DRL) 1.1.

Run these rules on your logs

Drop a .evtx file into the viewer: all 2,395 bundled SigmaHQ rules run locally in your browser. Nothing is uploaded.

Open the viewer Filter a log on event 8002