From cybersec-toolkit
Analyzes Windows Event 4624 logon type 3 with NTLMSSP to detect NTLM relay attacks, including IP-hostname mismatches, Responder traffic, and SMB signing issues.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersec-toolkit:hunting-for-ntlm-relay-attacksThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
NTLM relay attacks intercept and forward NTLM authentication messages to gain unauthorized access to network resources. Attackers use tools like Responder for LLMNR/NBT-NS poisoning and ntlmrelayx for credential relay. This skill detects relay activity by querying Windows Security Event 4624 (successful logon) for type 3 network logons with NTLMSSP authentication, identifying mismatches between...
NTLM relay attacks intercept and forward NTLM authentication messages to gain unauthorized access to network resources. Attackers use tools like Responder for LLMNR/NBT-NS poisoning and ntlmrelayx for credential relay. This skill detects relay activity by querying Windows Security Event 4624 (successful logon) for type 3 network logons with NTLMSSP authentication, identifying mismatches between WorkstationName and source IpAddress, detecting rapid multi-host authentication from single accounts, and auditing SMB signing configuration across domain hosts.
JSON report with suspected relay events, IP-hostname correlation anomalies, SMB signing audit results, and MITRE ATT&CK mapping to T1557.001.
npx claudepluginhub 26zl/cybersec-toolkit --plugin cybersec-toolkitAnalyzes Windows Event 4624 logon type 3 with NTLMSSP to detect NTLM relay attacks, including IP-hostname mismatches, Responder traffic, and SMB signing issues.
Detects NTLM relay attacks by analyzing Windows Event 4624 logs for logon type 3 NTLMSSP auth, IP-hostname mismatches, Responder signatures, SMB signing, and suspicious domain patterns. For threat hunting.
Detects NTLM relay attacks by analyzing Windows event 4624 for NTLMSSP auth, IP-hostname mismatches, Responder traffic signatures, SMB signing status, and cross-domain suspicious patterns. Useful for threat hunting in AD environments.