[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71G5VRH9BQSDBVKXTZ06S98":3,"skill-same:01M71G5VRH9BQSDBVKXTZ06S98":104},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":77,"commitSha":78,"skillDirectory":79,"forksCount":14,"repositoryHtmlUrl":80,"repositoryHomepageUrl":6,"ownerHtmlUrl":81,"ownerBlogUrl":6,"ownerDescription":82,"updatedAt":83,"install":84,"resources":97},"01M71G5VRH9BQSDBVKXTZ06S98","hunting-ntlmrelay-detect",null,"Detect NTLM relay attacks by analyzing Windows Event 4624 logon type 3 with NTLMSSP authentication, identifying IP-to-hostname mismatches, Responder traffic signatures, SMB signing status, and suspicious authentication patterns across the domain.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsoc\u002Fhunting\u002Fntlmrelay\u002Fdetect\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"hunting ntlmrelay detect","hunting","detect","community","traffic","de","hostname","ip","across","signatures","suspicious","cm","command","access","Bash","analysis","smb","server","authentication","cybersecurity","2026-11-10 10:12:30",false,"---\nname: hunting-ntlmrelay-detect\ndescription: Detect NTLM relay attacks by analyzing Windows Event 4624 logon type 3 with NTLMSSP authentication, identifying IP-to-hostname mismatches, Responder traffic signatures, SMB signing status, and suspicious authentication patterns across the domain.\ndomain: cybersecurity\nsubdomain: threat-hunting\ntags:\n- NTLM-relay\n- Windows-events\n- Event-4624\n- NTLMSSP\n- Responder\n- SMB-signing\n- credential-access\n- T1557.001\n- Active-Directory\nd3fend_techniques:\n- Application Protocol Command Analysis\n- Network Isolation\n- Network Traffic Analysis\n- Client-server Payload Profiling\n- Network Traffic Community Deviation\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- DE.AE-07\n- ID.RA-05\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1003\n- T1021.002\n- T1550.002\n- T1557.001\ncapec: []\n---\n\n# Hunting for NTLM Relay Attacks\n\n## Overview\n\nNTLM relay attacks intercept and forward NTLM authentication messages to gain unauthorized access to network resources. Attackers use tools like Responder for LLMNR\u002FNBT-NS poisoning and ntlmrelayx for credential relay. This skill detects relay activity by querying Windows Security Event 4624 (successful logon) for type 3 network logons with NTLMSSP authentication, identifying mismatches between WorkstationName and source IpAddress, detecting rapid multi-host authentication from single accounts, and auditing SMB signing configuration across domain hosts.\n\n\n## When to Use\n\n- When investigating security incidents that require hunting for ntlm relay attacks\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with Windows Event Log access or exported logs\n- Windows Security audit logging enabled (Event ID 4624, 4625, 5145)\n- Network access for SMB signing status checks\n\n## Key Detection Areas\n\n1. **IP-hostname mismatch** — WorkstationName in Event 4624 does not resolve to the source IpAddress\n2. **NTLMSSP authentication** — logon events using NTLM instead of Kerberos from domain-joined hosts\n3. **Machine account relay** — computer accounts (ending in $) authenticating from unexpected IPs\n4. **Rapid authentication** — single account authenticating to multiple hosts within seconds\n5. **Named pipe access** — Event 5145 showing access to Spoolss, lsarpc, netlogon, samr pipes\n6. **SMB signing disabled** — hosts not enforcing SMB signing, enabling relay attacks\n\n## Output\n\nJSON report with suspected relay events, IP-hostname correlation anomalies, SMB signing audit results, and MITRE ATT&CK mapping to T1557.001.\n","# Hunting for NTLM Relay Attacks\n\n## Overview\n\nNTLM relay attacks intercept and forward NTLM authentication messages to gain unauthorized access to network resources. Attackers use tools like Responder for LLMNR\u002FNBT-NS poisoning and ntlmrelayx for credential relay. This skill detects relay activity by querying Windows Security Event 4624 (successful logon) for type 3 network logons with NTLMSSP authentication, identifying mismatches between WorkstationName and source IpAddress, detecting rapid multi-host authentication from single accounts, and auditing SMB signing configuration across domain hosts.\n\n\n## When to Use\n\n- When investigating security incidents that require hunting for ntlm relay attacks\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with Windows Event Log access or exported logs\n- Windows Security audit logging enabled (Event ID 4624, 4625, 5145)\n- Network access for SMB signing status checks\n\n## Key Detection Areas\n\n1. **IP-hostname mismatch** — WorkstationName in Event 4624 does not resolve to the source IpAddress\n2. **NTLMSSP authentication** — logon events using NTLM instead of Kerberos from domain-joined hosts\n3. **Machine account relay** — computer accounts (ending in $) authenticating from unexpected IPs\n4. **Rapid authentication** — single account authenticating to multiple hosts within seconds\n5. **Named pipe access** — Event 5145 showing access to Spoolss, lsarpc, netlogon, samr pipes\n6. **SMB signing disabled** — hosts not enforcing SMB signing, enabling relay attacks\n\n## Output\n\nJSON report with suspected relay events, IP-hostname correlation anomalies, SMB signing audit results, and MITRE ATT&CK mapping to T1557.001.\n",{"name":5,"tags":44,"capec":54,"model":55,"tools":56,"domain":38,"maxTurns":60,"nist_csf":61,"subdomain":66,"description":7,"mitre_attack":67,"d3fend_techniques":71},[45,46,47,48,49,50,51,52,53],"NTLM-relay","Windows-events","Event-4624","NTLMSSP","Responder","SMB-signing","credential-access","T1557.001","Active-Directory",[],"sonnet",[57,33,58,59],"Read","Glob","Grep",20,[62,63,64,65],"DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05","threat-hunting",[68,69,70,52],"T1003","T1021.002","T1550.002",[72,73,74,75,76],"Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fsoc\u002Fhunting\u002Fntlmrelay\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":85,"prompt":95,"zipAvailable":96},[86,89,92],{"tool":87,"command":88},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill hunting-ntlmrelay-detect",{"tool":90,"command":91},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill hunting-ntlmrelay-detect",{"tool":93,"command":94},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill hunting-ntlmrelay-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsoc\u002Fhunting\u002Fntlmrelay\u002Fdetect\u002FSKILL.md",true,[98],{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"index.json","REFERENCE","参考文档",679,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fsoc\u002Fhunting\u002Fntlmrelay\u002Fdetect\u002Findex.json",[105,127,145,166,188,204],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[112,21,113,114,115,24,30,116,117,118,119,120,121,122,123,124,125,38,126],"services","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[134,112,135,114,136,137,23,38,33,34,138,27,139,140,24,31,141,142,143,144],"exploit","services wmi exec exploit","exec","remote","team","crackmapexec","native","lateral movement","read","lateral-movement","Impacket",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":151,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[152,153,154,155,156,157,38,33,158,34,159,160,24,142,161,162,163,164,165,55],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":172,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[21,173,174,175,176,177,178,30,179,38,126,180,181,182,183,184,185,186,187,24],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":194,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[195,196,21,197,175,177,198,30,199,179,38,126,34,200,201,202,203,187,24,116],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":210,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[211,21,175,212,198,30,213,214,38,126,215,216,217,218,219,220,24,116,221,222],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]