Help me with the SPL

[Akhanda]

Hi,
Could some one pls help me the lateral movement which  look for a user with remote NTLM (type 3) logins on an abnormal number of destinations.

Thanks

[ITWhisperer]

I am not sure what that ask is here

What is your concern regarding plagarism? If I rewrite this SPL and you use it, are you then not plagarising my SPL?

It is not clear what NTLM (type 3) is - could you just change the Logon_Type or LogonType part of the search to look for 3 instead of 10?

Please share some anonymised events so we can see what you are dealing with, and an indication of the expected output?

[Akhanda]

@ITWhisperer ,

Usecase is related to Lateral movement 

Thanks.

[Akhanda]

@ITWhisperer ,

This above query is based on  
https://www.splunk.com/en_us/blog/security/active-directory-lateral-movement-detection-threat-resear...
if possible pls help me in making a query as per the sample event.
thanks

[ITWhisperer]

Sorry, I am not a security expert.