detecting-ntlm-relay-with-event-correlation
0
Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB and LDAP signing enforcement across the domain, and detecting NTLM downgrade attacks from NTLMv2 to NTLMv1 using event log analysis.
Install this skill
Run this command in your terminal. No account required — it auto-detects your AI tool and installs the skill file.
npx @skills-hub-ai/cli install cybersecurity-skills-detecting-ntlm-relay-with-event-correlationOr download directly:
View all CLI commands →Setup by platform
Instructions
Security
Loading security scan...