Skip to main content
AI/MLplurigrid

hunting-for-ntlm-relay-attacks

Detect NTLM relay attacks by analyzing Windows Event 4624 logon type 3 with NTLMSSP authentication, identifying IP-to-hostname mismatches, Responder traffic signatures, SMB signing status, and suspicious authentication patterns across the domain.

Stars
23
Source
plurigrid/asi
Updated
2026-04-26
Slug
plurigrid--asi--hunting-for-ntlm-relay-attacks
View on GitHubRaw SKILL.md

// install — copy + paste into any project

mkdir -p .claude/skills && curl -fsSL https://raw.githubusercontent.com/plurigrid/asi/HEAD/plugins/asi/skills/hunting-for-ntlm-relay-attacks/SKILL.md -o .claude/skills/hunting-for-ntlm-relay-attacks.md

Drops the SKILL.md into .claude/skills/hunting-for-ntlm-relay-attacks.md. Works with Claude Code, Cursor, and any agent that loads SKILL.md files from .claude/skills/.

Hunting for NTLM Relay Attacks

Overview

NTLM relay attacks intercept and forward NTLM authentication messages to gain unauthorized access to network resources. Attackers use tools like Responder for LLMNR/NBT-NS poisoning and ntlmrelayx for credential relay. This skill detects relay activity by querying Windows Security Event 4624 (successful logon) for type 3 network logons with NTLMSSP authentication, identifying mismatches between WorkstationName and source IpAddress, detecting rapid multi-host authentication from single accounts, and auditing SMB signing configuration across domain hosts.

When to Use

  • When investigating security incidents that require hunting for ntlm relay attacks
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Python 3.9+ with Windows Event Log access or exported logs
  • Windows Security audit logging enabled (Event ID 4624, 4625, 5145)
  • Network access for SMB signing status checks

Key Detection Areas

  1. IP-hostname mismatch — WorkstationName in Event 4624 does not resolve to the source IpAddress
  2. NTLMSSP authentication — logon events using NTLM instead of Kerberos from domain-joined hosts
  3. Machine account relay — computer accounts (ending in $) authenticating from unexpected IPs
  4. Rapid authentication — single account authenticating to multiple hosts within seconds
  5. Named pipe access — Event 5145 showing access to Spoolss, lsarpc, netlogon, samr pipes
  6. SMB signing disabled — hosts not enforcing SMB signing, enabling relay attacks

Output

JSON report with suspected relay events, IP-hostname correlation anomalies, SMB signing audit results, and MITRE ATT&CK mapping to T1557.001.