{"slug":"hunting-for-ntlm-relay-attacks","source_name":"hunting-for-ntlm-relay-attacks","name":"Hunting For Ntlm Relay Attacks","description":"Detect NTLM relay attacks by analyzing Windows Event 4624 logon type 3 with NTLMSSP authentication, identifying IP-to-hostname mismatches, Responder traffic signatures, SMB signing status, and suspicious authentication patterns across the domain.","version":1,"lift":{"pass_rate_delta_pts":0,"pass_rate_pct":4.3,"total_cases":23,"passed_cases":1,"tokens_delta_pct":1.4,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-07-28T03:14:06.643447+00:00"},"skill_score":null,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":0,"with_pass_pct":50,"without_pass_pct":50,"tokens_delta_pct":1.4,"turns_delta_pct":0,"total_cases":23,"cases_aggregated":23,"verdict":"mixed","never_hurt":false,"completed_at":"2026-07-28T03:14:06.643447+00:00","run_id":"47e749bf-9708-485c-9125-b532bf460138","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":null,"content_status":"clean","indexable":true},"license":"Apache-2.0","install_count":0,"manifest_hash":"6b464527bdc561ac94c5e2c424776267a38d2177c954c61399badcc30f19dfa5","raw_url":"https://app.decimal.ai/s/hunting-for-ntlm-relay-attacks/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/hunting-for-ntlm-relay-attacks"}