topic Re: Detect and prevent NTLM traffic in Firewall and Security Management

Detect and prevent NTLM traffic

Rodrigo_Silva — Tue, 03 Mar 2026 14:27:43 GMT

Hi everyone,

Is there a way to monitor all NTLM authentication traffic going through my network?

I couldn’t find a way to identify it using HTTPS Inspection.

I need to detect and later enforce a full block on all NTLM authentication traffic.

Has anyone done this before?

Re: Detect and prevent NTLM traffic

Vincent_Bacher — Tue, 03 Mar 2026 14:44:10 GMT

Are you using IPS? If yes maybe to compile a snort rule to detect ntlm auth over https would be an idea?

Re: Detect and prevent NTLM traffic

Martijn — Tue, 03 Mar 2026 14:57:16 GMT

Hi,

Can't you use Application Control. There is a Windows NTLM application there.

"Windows Challange/Response (NTLM) is the authentication protocol used on networks that include systems running the Windows operating system on stand-alone systems."

Category: Network Protocols
Risk: Low (2)

Or did you already tried that?

Martijn

Re: Detect and prevent NTLM traffic

Rodrigo_Silva — Tue, 03 Mar 2026 15:04:28 GMT

Yes, I already tried it but it didn’t detect anything.

Re: Detect and prevent NTLM traffic

Rodrigo_Silva — Tue, 03 Mar 2026 15:07:02 GMT

Yes, I have IPS enabled, but I’ve never worked with Snort rules before. I’ll look into it. Thanks for the tip.

Re: Detect and prevent NTLM traffic

Rodrigo_Silva — Fri, 06 Mar 2026 15:45:24 GMT

Thank you for the tip.

I created the rule below and was able to detect and prevent NTLM traffic using the IPS blade.

alert tcp any any -> any $HTTP_PORTS (msg:"NTLM authentication over TCP"; flow:to_server,established; content:"Authorization|3a|"; nocase; http_header; content:"NTLM"; nocase; distance:0; within:64; http_header; classtype:policy-violation;)

Of course, I also had to enable HTTPS Inspection for the internal network.

Best regards