| name | hunting-for-ntlm-relay-attacks |
| description | Detect NTLM relay attacks by analyzing Windows Event 4624 logon type 3 with NTLMSSP authentication, identifying IP-to-hostname mismatches, Responder traffic signatures, SMB signing status, and suspicious authentication patterns across the domain. Use when detecting ntlm relay attacks by analyzing windows event 4624 logon. |
| domain | cybersecurity |
| subdomain | threat-hunting |
| tags | ["NTLM-relay","Windows-events","Event-4624","NTLMSSP","Responder","SMB-signing","credential-access","T1557.001","Active-Directory"] |
| version | 1.0 |
| author | oyi77 |
| license | Apache-2.0 |
| d3fend_techniques | ["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation"] |
| nist_csf | ["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"] |
Hunting for NTLM Relay Attacks
Overview
NTLM relay attacks intercept and forward NTLM authentication messages to gain unauthorized access to network resources. Attackers use tools like Responder for LLMNR/NBT-NS poisoning and ntlmrelayx for credential relay. This skill detects relay activity by querying Windows Security Event 4624 (successful logon) for type 3 network logons with NTLMSSP authentication, identifying mismatches between WorkstationName and source IpAddress, detecting rapid multi-host authentication from single accounts, and auditing SMB signing configuration across domain hosts.
When to Use
Trigger phrases:
-
"hunting for ntlm relay attacks"
-
"Detect NTLM relay attacks by analyzing Windows Event 4624 logon type 3 with NTLM"
-
When investigating security incidents that require hunting for ntlm relay attacks
-
When building detection rules or threat hunting queries for this domain
-
When SOC analysts need structured procedures for this analysis type
-
When validating security monitoring coverage for related attack techniques
When NOT to Use
- When you lack proper authorization for testing
- For production systems without change management
- When the task requires legal or compliance expertise beyond technical scope
Prerequisites
- Python 3.9+ with Windows Event Log access or exported logs
- Windows Security audit logging enabled (Event ID 4624, 4625, 5145)
- Network access for SMB signing status checks
Key Detection Areas
- IP-hostname mismatch — WorkstationName in Event 4624 does not resolve to the source IpAddress
- NTLMSSP authentication — logon events using NTLM instead of Kerberos from domain-joined hosts
- Machine account relay — computer accounts (ending in $) authenticating from unexpected IPs
- Rapid authentication — single account authenticating to multiple hosts within seconds
- Named pipe access — Event 5145 showing access to Spoolss, lsarpc, netlogon, samr pipes
- SMB signing disabled — hosts not enforcing SMB signing, enabling relay attacks
Red Flags
- Performing actions without explicit written authorization from the asset owner
- Testing against production systems without a defined scope and rules of engagement
- Exceeding the authorized scope of the engagement
