NTLM on Purpleshifthttps://purpleshift.io/tags/ntlm/Recent content in NTLM on PurpleshiftHugo -- gohugo.ioen© 2026Fri, 08 May 2026 09:48:48 +0000New NTLM audit events help to detect coercing attackshttps://purpleshift.io/purple/2026-05-08-biat/Fri, 08 May 2026 09:48:48 +0000https://purpleshift.io/purple/2026-05-08-biat/A chain of events 4023 and 4021 from the same IP address means an attack