// REFERENCE
4776 — NTLM credential validation
Log: Security
Medium risk
The domain controller validated credentials via NTLM. Heavy NTLM use (versus Kerberos) or validations from unexpected hosts can indicate pass-the-hash or misconfigured legacy apps.
Related tools
Work with this in:
Related
4768
4768 — Kerberos TGT requested (AS-REQ) 4769
4769 — Kerberos service ticket requested (TGS-REQ) 4770
4770 — Kerberos service ticket renewed 4771
4771 — Kerberos pre-authentication failed
4768 — Kerberos TGT requested (AS-REQ) 4769
4769 — Kerberos service ticket requested (TGS-REQ) 4770
4770 — Kerberos service ticket renewed 4771
4771 — Kerberos pre-authentication failed
Original descriptions based on Microsoft's public documentation. IDs and fields may vary with the Windows version and the active audit policy.