explainx.ainewsletter3.4k
tag

detecting-ntlm-relay-with-event-correlation▌

1 indexed skills · max 10 per page

skills (1)

detecting-ntlm-relay-with-event-correlation

mukul975/Anthropic-Cybersecurity-Skills · detecting-ntlm-relay-with-event-correlation

0

Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB and LDAP signing enforcement across the domain, and detecting NTLM downgrade attacks from NTLMv2 to NTLMv1 using event log analysis.