NTLM Reflection attack: when it works
Under what conditions can a non-domain Windows host be compromised
NTLM
NetNTLM hashes leak through Snipping Tool
How to prevent exploitation of a vulnerability in a popular image editing tool
New NTLM audit events help to detect coercing attacks
A chain of events 4023 and 4021 from the same IP address means an attack