New NTLM audit events help to detect coercing attacks8 May 2026·1 minPurpleshiftBlueTeam NTLMA chain of events 4023 and 4021 from the same IP address means an attack