domains / families / security / detecting-ntlm-relay-with-event-correlation

detecting-ntlm-relay-with-event-correlation

separate

Detect NTLM relay attacks (T1557.001) by correlating Windows Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts, auditing SMB/LDAP signing, and flagging NTLMv2-to-NTLMv1 downgrades. Use for hunting credential relay in NTLM-enabled AD, investigating auth-source anomalies, building SIEM correlation rules, or responding to PetitPotam/DFSCoerce/PrinterBug alerts.

When to use

• Hunting for credential relay activity in Active Directory environments where NTLM authentication is still in use
• Investigating alerts for authentication anomalies where the source IP does not match the expected workstation
• Auditing SMB signing and LDAP signing enforcement to assess exposure to relay attacks
• Detecting NTLM downgrade attacks where NTLMv2 is forced to NTLMv1 for easier offline cracking or relay
• Building SIEM correlation rules for MITRE ATT&CK T1557.001 (LLMNR/NBT-NS Poisoning and SMB Relay)
• Responding to PetitPotam, DFSCoerce, or PrinterBug coercion alerts that may precede relay attacks
• During purple team exercises validating NTLM relay detection and SMB signing enforcement

When not to use

• Use without centralized Windows Security Event Log collection
• Substitute for enforcing SMB signing and Extended Protection for Authentication (EPA)
• Use without an IP-to-hostname inventory for correlation

Skill page

Source