Investigate NTLM relay, an attack that forwards authentication messages to another service, by comparing Windows login events with host inventories. Use the supplied queries and audits to identify suspicious sources, weaker authentication, and gaps in signing enforcement.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
- Investigating mismatched login source addresses and hostnames
- Building SIEM rules to detect NTLM relay
- Auditing SMB and LDAP signing requirements
mukul975/Anthropic-Cybersecurity-Skills☆ 3.5만2026년 8월 31일 업데이트
Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB and LDAP signing enforcement across the domain, and detecting NTLM downgrade attacks from NTLMv2 to NTLMv1 using event log analysis.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
andycungkrinx91/konoha☆ 92026년 10월 19일 업데이트
Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB and LDAP signing enforcement across the domain, and detecting NTLM downgrade attacks from NTLMv2 to NTLMv1 using event log analysis.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
micsapp/micstec-skills☆ 42026년 3월 20일 업데이트
Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB and LDAP signing enforcement across the domain, and detecting NTLM downgrade attacks from NTLMv2 to NTLMv1 using event log analysis.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
aniket2348823/Vul-Agent☆ 22026년 6월 9일 업데이트