About

Imported from mukul975/anthropic-cybersecurity-skills (skills/hunting-for-ntlm-relay-attacks/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill hunting-for-ntlm-relay-attacks. Copyright stays with the author (Apache-2.0).

Hunting for NTLM Relay Attacks

Name: hunting-for-ntlm-relay-attacks
Author: mukul975

Overview

NTLM relay attacks intercept and forward NTLM authentication messages to gain unauthorized access to network resources. Attackers use tools like Responder for LLMNR/NBT-NS poisoning and ntlmrelayx for credential relay. This skill detects relay activity by querying Windows Security Event 4624 (successful logon) for type 3 network logons with NTLMSSP authentication, identifying mismatches between WorkstationName and source IpAddress, detecting rapid multi-host authentication from single accounts, and auditing SMB signing configuration across domain hosts.

When to Use

When investigating security incidents that require hunting for ntlm relay attacks
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Python 3.9+ with Windows Event Log access or exported logs
Windows Security audit logging enabled (Event ID 4624, 4625, 5145)
Network access for SMB signing status checks

Key Detection Areas

IP-hostname mismatch — WorkstationName in Event 4624 does not resolve to the source IpAddress
NTLMSSP authentication — logon events using NTLM instead of Kerberos from domain-joined hosts
Machine account relay — computer accounts (ending in $) authenticating from unexpected IPs
Rapid authentication — single account authenticating to multiple hosts within seconds
Named pipe access — Event 5145 showing access to Spoolss, lsarpc, netlogon, samr pipes
SMB signing disabled — hosts not enforcing SMB signing, enabling relay attacks

Output

JSON report with suspected relay events, IP-hostname correlation anomalies, SMB signing audit results, and MITRE ATT&CK mapping to T1557.001.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-hunting-for-ntlm-19cd94/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-hunting-for-ntlm-19cd94.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-hunting-for-ntlm-19cd94",
  "kind": "skill",
  "name": "hunting-for-ntlm-relay-attacks",
  "description": "Detects NTLM relay attacks (MITRE T1557.001) by analyzing Windows Event ID 4624 logon type 3 with NTLMSSP authentication, flagging IP-to-hostname mismatches, Responder/LLMNR poisoning signatures, SMB signing status, and anomalous cross-domain authentication patterns. Use when investigating credential-relay activity in Active Directory or building detections for NTLM relay and coercion-based attacks.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "ntlm-relay",
      "windows-events",
      "event-4624",
      "ntlmssp",
      "responder",
      "smb-signing",
      "credential-access",
      "t1557-001",
      "active-directory"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Detects NTLM relay attacks (MITRE T1557.001) by analyzing Windows Event ID 4624 logon type 3 with NTLMSSP authentication, flagging IP-to-hostname mismatches, Responder/LLMNR poisoning signatures, SMB signing status, and anomalous cross-domain authentication patterns. Use when investigating credential-relay activity in Active Directory or building detections for NTLM relay and coercion-based attacks."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/hunting-for-ntlm-relay-attacks/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/hunting-for-ntlm-relay-attacks/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/hunting-for-ntlm-relay-attacks/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Hunting for NTLM Relay Attacks\n\n## Overview\n\nNTLM relay attacks intercept and forward NTLM authentication messages to gain unauthorized access to network resources. Attackers use tools like Responder for LLMNR/NBT-NS poisoning and ntlmrelayx for credential relay. This skill detects relay activity by querying Windows Security Event 4624 (successful logon) for type 3 network logons with NTLMSSP authentication, identifying mismatches between WorkstationName and source IpAddress, detecting rapid multi-host authentication from single accounts, and auditing SMB signing configuration across domain ",
  "cost": {
    "context_tokens": 469
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-hunting-for-ntlm-19cd94/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.