Cybersecurity
Detecting NTLM Relay With Event Correlation
Detect NTLM relay attacks (T1557.001) by correlating Windows Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB/LDAP signing, and flagging NTLMv2-to-NTLMv1 downgrades. Use for hunting credential relay in NTLM-enabled AD, investigating auth-source anomalies, building SIEM correlation rules, or responding to PetitPotam/DFSCoerce/PrinterBug alerts.
- Publisher / source
- Cybersecurity Skills (Community)
- Upstream record
- mukul975/Anthropic-Cybersecurity-Skills
- Version
- Version 5
- Published
- Publication review
- Approved for publication · recorded passed scan 2026-11-03
- Content fingerprint
405096113a2c58da5f44560d60232240769652d64c987ef8eeaf78d19a413229