Detection rules › By eventMicrosoft-Windows-NTLM event 80021 detection rule reference this event. View event page.Sigma (1)NTLM Logon severity low T1550.002