skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-ntlm-relay-with-event-correlation

Detect NTLM relay attacks by correlating Windows Security Event 4624 with network and audit logs.

954|172|Updated Mar 13, 2026
Search Tags:#threat hunting#Active Directory#NTLM relay#smb signing#responder detection#siem correlation#event 4624
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-ntlm-relay-with-event-correlation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-ntlm-relay-with-event-correlation
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/detecting-ntlm-relay-with-event-correlation
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-ntlm-relay-with-event-correlation

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

NTLM relay attacks let adversaries authenticate as victims without knowing passwords, and they are hard to spot in raw logs. This Skill provides a structured detection framework that correlates Windows Security Events, network traffic, and configuration audits to surface relay activity in Active Directory environments.

Core Features & Use Cases

  • Event 4624 Correlation: Detect IP-to-hostname mismatches in LogonType 3 NTLM authentications using Splunk SPL and Microsoft Sentinel KQL queries.
  • Poisoning and Coercion Detection: Identify Responder LLMNR/NBT-NS/mDNS poisoning and PetitPotam, DFSCoerce, or PrinterBug machine-account coercion.
  • SMB/LDAP Signing and Downgrade Audits: Audit SMB signing, LDAP signing, channel binding, and NTLMv1 downgrade activity across the domain with PowerShell.
  • Use Case: A threat hunter investigating anomalous authentication runs the IP-hostname mismatch query against forwarded Windows event logs, confirms a machine account authenticating from an unexpected IP, and validates SMB signing enforcement on affected servers.

Quick Start

Ask the AI to build a Splunk or Sentinel query that detects NTLM relay by finding Event 4624 LogonType 3 entries where the source IP does not match the workstation's expected address.

Frequently Asked Questions about detecting-ntlm-relay-with-event-correlation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect NTLM relay attacks in Windows event logs?▼

Correlate Event 4624 LogonType 3 entries where AuthenticationPackageName is NTLM against an IP-to-hostname inventory. A mismatch between the WorkstationName field and the source IpAddress indicates the authentication was relayed through a third party.

What is the best way to detect Responder LLMNR poisoning?▼

Monitor network logs for a single host responding to LLMNR (UDP 5355), NBT-NS (UDP 137), and mDNS (UDP 5353) queries from multiple unique sources. Legitimate DNS servers should be excluded, and more than five victims in five minutes is a strong signal.

Does SMB signing prevent NTLM relay attacks?▼

Yes, requiring SMB signing prevents relay to SMB services because the attacker cannot forge signed packets. Signing must be set to Required rather than just Enabled, and LDAP signing plus channel binding is needed to protect LDAP services.

Can this detection work without centralized log collection?▼

No, the correlation queries require Windows Security Events forwarded from all potential relay targets, including member servers and domain controllers, via WEF or agents to a SIEM. Local-only log review misses cross-host relay patterns.

Why does NTLM relay detection produce false positives?▼

Legitimate machine-account NTLM during cluster failover and NAT or proxy devices that collapse many sources into one IP mimic relay patterns. Allowlist NAT egress IPs and cluster nodes, and keep the IP-to-hostname inventory current.

How do I detect PetitPotam coercion attacks?▼

Look for computer accounts ending in $ authenticating via NTLM LogonType 3 from an IP address that is not their own, especially domain controller accounts. This pattern indicates coerced machine authentication being relayed to another service.

Related Skills

Explore More Software Engineering Skills→
ryantsairyantsai
434

dns-dhcp-troubleshooter

Diagnose DNS and DHCP issues across KKTerm environments.

Community
Advanced
Prohao42Prohao42
120

ntlm-relay-coercion

Relay NTLM authentication to SMB, LDAP, HTTP, or MSSQL targets.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

adcs-template-abuse

Exploit misconfigured AD CS templates to impersonate domain users via SAN manipulation.

Official
Advanced
OpenTideHQOpenTideHQ
4

active-directory

Map Active Directory authentication, replication, and trust mechanisms to detection requirements.

Official
Advanced