Reliably Detecting Pass the Hash Through Event Log Analysis