Pass-the-Hash / Overpass-the-Hash

Detects Pass-the-Hash techniques via sekurlsa, pth-winexe, Rubeus, or similar tools that abuse NTLM hashes for authentication.