events from two sources (the source host and the target host), is described in the research paper titled "PassThe-Hash Detection With Windows Event Viewer" 16. You can also track NTLM connections in network traffic. In