Agent-Skills.md

Agent Skills: Hunting for NTLM Relay Attacks

Detect NTLM relay attacks by analyzing Windows Event 4624 logon type 3 with NTLMSSP authentication, identifying IP-to-hostname mismatches, Responder traffic signatures, SMB signing status, and suspicious authentication patterns across the domain.

UncategorizedID: plurigrid/asi/hunting-for-ntlm-relay-attacks

Repository

plurigrid/asi
plurigridLicense: MIT
165

Install this agent skill to your local

pnpm dlx add-skill https://github.com/plurigrid/asi/tree/HEAD/plugins/asi/skills/hunting-for-ntlm-relay-attacks

Skill Files

Browse the full folder contents for hunting-for-ntlm-relay-attacks.

Download Skill

Loading file tree…

plugins/asi/skills/hunting-for-ntlm-relay-attacks/SKILL.md

Skill Metadata

Name
hunting-for-ntlm-relay-attacks
Description
Detect NTLM relay attacks by analyzing Windows Event 4624 logon type 3 with NTLMSSP authentication, identifying IP-to-hostname mismatches, Responder traffic signatures, SMB signing status, and suspicious authentication patterns across the domain.

Hunting for NTLM Relay Attacks

Overview

NTLM relay attacks intercept and forward NTLM authentication messages to gain unauthorized access to network resources. Attackers use tools like Responder for LLMNR/NBT-NS poisoning and ntlmrelayx for credential relay. This skill detects relay activity by querying Windows Security Event 4624 (successful logon) for type 3 network logons with NTLMSSP authentication, identifying mismatches between WorkstationName and source IpAddress, detecting rapid multi-host authentication from single accounts, and auditing SMB signing configuration across domain hosts.

When to Use

  • When investigating security incidents that require hunting for ntlm relay attacks
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Python 3.9+ with Windows Event Log access or exported logs
  • Windows Security audit logging enabled (Event ID 4624, 4625, 5145)
  • Network access for SMB signing status checks

Key Detection Areas

  1. IP-hostname mismatch — WorkstationName in Event 4624 does not resolve to the source IpAddress
  2. NTLMSSP authentication — logon events using NTLM instead of Kerberos from domain-joined hosts
  3. Machine account relay — computer accounts (ending in $) authenticating from unexpected IPs
  4. Rapid authentication — single account authenticating to multiple hosts within seconds
  5. Named pipe access — Event 5145 showing access to Spoolss, lsarpc, netlogon, samr pipes
  6. SMB signing disabled — hosts not enforcing SMB signing, enabling relay attacks

Output

JSON report with suspected relay events, IP-hostname correlation anomalies, SMB signing audit results, and MITRE ATT&CK mapping to T1557.001.