We of course have the Vision product so I can say with certainty this method works. You could certainly roll your own if you are gathering event logs across your domain.
https://www.binarydefense.com/bds/reliably-detecting-pass-the-hash-through-event-log-analysis/
