What it does. Detects NTLM relay attacks (MITRE T1557.001) by analyzing Windows Event Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-ntlm-relay-attacks, or copy the skill folder into ~/.claude/skills/hunting-for-ntlm-relay-attacks/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-ntlm-relay-attacks/SKILL.md

SKILL.md (verbatim)

name: hunting-for-ntlm-relay-attacks
description: Detects NTLM relay attacks (MITRE T1557.001) by analyzing Windows Event
  ID 4624 logon type 3 with NTLMSSP authentication, flagging IP-to-hostname mismatches,
  Responder/LLMNR poisoning signatures, SMB signing status, and anomalous cross-domain
  authentication patterns. Use when investigating credential-relay activity in Active
  Directory or building detections for NTLM relay and coercion-based attacks.
domain: cybersecurity
subdomain: threat-hunting
tags:
- NTLM-relay
- Windows-events
- Event-4624
- NTLMSSP
- Responder
- SMB-signing
- credential-access
- T1557.001
- Active-Directory
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Application Protocol Command Analysis
- Network Isolation
- Network Traffic Analysis
- Client-server Payload Profiling
- Network Traffic Community Deviation
nist_csf:
- DE.CM-01
- DE.AE-02
- DE.AE-07
- ID.RA-05
mitre_attack:
- T1046
- T1057
- T1082
- T1083
- T1003

Hunting for NTLM Relay Attacks

Overview

NTLM relay attacks intercept and forward NTLM authentication messages to gain unauthorized access to network resources. Attackers use tools like Responder for LLMNR/NBT-NS poisoning and ntlmrelayx for credential relay. This skill detects relay activity by querying Windows Security Event 4624 (successful logon) for type 3 network logons with NTLMSSP authentication, identifying mismatches between WorkstationName and source IpAddress, detecting rapid multi-host authentication from single accounts, and auditing SMB signing configuration across domain hosts.

When to Use

• When investigating security incidents that require hunting for ntlm relay attacks
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Prerequisites

• Python 3.9+ with Windows Event Log access or exported logs
• Windows Security audit logging enabled (Event ID 4624, 4625, 5145)
• Network access for SMB signing status checks

Key Detection Areas

1. IP-hostname mismatch — WorkstationName in Event 4624 does not resolve to the source IpAddress
2. NTLMSSP authentication — logon events using NTLM instead of Kerberos from domain-joined hosts
3. Machine account relay — computer accounts (ending in $) authenticating from unexpected IPs
4. Rapid authentication — single account authenticating to multiple hosts within seconds
5. Named pipe access — Event 5145 showing access to Spoolss, lsarpc, netlogon, samr pipes
6. SMB signing disabled — hosts not enforcing SMB signing, enabling relay attacks

Output

JSON report with suspected relay events, IP-hostname correlation anomalies, SMB signing audit results, and MITRE ATT&CK mapping to T1557.001.

Other files in this skill

• LICENSE
• references/api-reference.md
• scripts/agent.py

references/api-reference.md (verbatim)

NTLM Relay Attack Detection Reference

Windows Event IDs

Event 4624 Fields for Relay Detection

Suspicious Named Pipes (Event 5145)

Splunk Detection Query

index=wineventlog EventCode=4624 Logon_Type=3 Authentication_Package=NTLM
| eval hostname_ip_match=if(Workstation_Name==src_ip OR isnull(Workstation_Name), "match", "mismatch")
| where hostname_ip_match="mismatch"
| stats count values(src_ip) as source_ips values(Workstation_Name) as workstations by Account_Name, Computer
| where count > 3

Elastic EQL Detection (NTLM Relay Against Computer Account)

sequence by winlog.computer_name with maxspan=5s
  [any where event.code == "5145" and
    winlog.event_data.RelativeTargetName in ("spoolss","netdfs","lsarpc","samr","efsrpc","netlogon") and
    winlog.event_data.SubjectUserName != winlog.computer_name]
  [authentication where event.code in ("4624","4625") and
    winlog.event_data.AuthenticationPackageName == "NTLM" and
    winlog.event_data.LogonType == "3" and
    winlog.event_data.TargetUserName : "*$"]

PowerShell Detection

# Query NTLM type 3 logons
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} |
  Where-Object {
    $_.Properties[8].Value -eq 3 -and
    $_.Properties[14].Value -match 'NTLM'
  } | Select-Object TimeCreated,
    @{N='User';E={$_.Properties[5].Value}},
    @{N='Workstation';E={$_.Properties[11].Value}},
    @{N='SourceIP';E={$_.Properties[18].Value}},
    @{N='AuthPkg';E={$_.Properties[14].Value}}

# Check SMB signing
Get-SmbServerConfiguration | Select-Object RequireSecuritySignature, EnableSecuritySignature

SMB Signing Enforcement

# Enable SMB signing (require on server)
Set-SmbServerConfiguration -RequireSecuritySignature $true -Force

# Group Policy path
# Computer Configuration > Policies > Windows Settings > Security Settings >
# Local Policies > Security Options >
# Microsoft network server: Digitally sign communications (always): Enabled

Common Relay Tools (Detection Signatures)

MITRE ATT&CK Mapping

• T1557.001 — Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
• T1187 — Forced Authentication
• T1003.001 — OS Credential Dumping: LSASS Memory
• TA0006 — Credential Access (Tactic)

Response Checklist

1. Enable SMB signing on all domain hosts via GPO
2. Disable LLMNR: Set-DnsClientGlobalSetting -SuffixSearchList @("")
3. Disable NBT-NS in network adapter advanced settings
4. Enable Extended Protection for Authentication (EPA)
5. Enforce NTLMv2 and deny NTLMv1: LmCompatibilityLevel = 5
6. Deploy SMB signing GPO: RequireSecuritySignature = 1

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.