Detects NTLM relay attacks (MITRE T1557.001) by analyzing Windows Event ID 4624 logon type 3 with NTLMSSP authentication, flagging IP-to-hostname mismatches, Responder/LLMNR poisoning signatures, SMB signing status, and anomalous cross-domain authentication patterns. Use when investigating credential-relay activity in Active Directory or building detections for NTLM relay and coercion-based attacks.
Start a fresh conversation. Replace the highlighted placeholders.
Use hunting-for-ntlm-relay-attacks to analyze [authorized Windows event logs] and [SMB-signing scope] for suspected NTLM relay activity, returning suspected events, correlation anomalies, signing findings, and ATT&CK mapping.
Required inputs
[authorized Windows event logs]
[SMB-signing scope]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: hunting-for-ntlm-relay-attacksdescription: Detects NTLM relay attacks (MITRE T1557.001) by analyzing Windows Event ID 4624 logon type 3 with NTLMSSP authentication, flagging IP-to-hostname mismatches, Responder/LLMNR poisoning signatures, SMB signing status, and anomalous cross-domain authentication patterns. Use when investigating credential-relay activity in Active Directory or building detections for NTLM relay and coercion-based attacks.domain: cybersecuritysubdomain: threat-huntingtags: - NTLM-relay- Windows-events- Event-4624- NTLMSSP- Responder- SMB-signing- credential-access- T1557.001- Active-Directoryversion: '1.0'author: mahipallicense: Apache-2.0d3fend_techniques: - Application Protocol Command Analysis- Network Isolation- Network Traffic Analysis- Client-server Payload Profiling- Network Traffic Community Deviationnist_csf: - DE.CM-01- DE.AE-02- DE.AE-07- ID.RA-05mitre_attack: - T1046- T1057- T1082- T1083- T1003
Hunting for NTLM Relay Attacks
Overview
NTLM relay attacks intercept and forward NTLM authentication messages to gain unauthorized access to network resources. Attackers use tools like Responder for LLMNR/NBT-NS poisoning and ntlmrelayx for credential relay. This skill detects relay activity by querying Windows Security Event 4624 (successful logon) for type 3 network logons with NTLMSSP authentication, identifying mismatches between WorkstationName and source IpAddress, detecting rapid multi-host authentication from single accounts, and auditing SMB signing configuration across domain hosts.
When to Use
When investigating security incidents that require hunting for ntlm relay attacks
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques
Prerequisites
Python 3.9+ with Windows Event Log access or exported logs
Windows Security audit logging enabled (Event ID 4624, 4625, 5145)
Network access for SMB signing status checks
Key Detection Areas
IP-hostname mismatch — WorkstationName in Event 4624 does not resolve to the source IpAddress
NTLMSSP authentication — logon events using NTLM instead of Kerberos from domain-joined hosts
Machine account relay — computer accounts (ending in $) authenticating from unexpected IPs
Rapid authentication — single account authenticating to multiple hosts within seconds
Named pipe access — Event 5145 showing access to Spoolss, lsarpc, netlogon, samr pipes