▸case-04 You are auditing Event ID 4624 logs for computer accounts authenticating across the domain. You notice `DC01$` authenticating via NTLMSSP to an internal file server from IP address `10.0.4.88`, which is an unassigned subnet in the DMZ rather than a domain controller IP. Why is an account ending with a dollar sign authenticating from an unexpected IP address significant in NTLM relay hunting? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-02 A security analyst is reviewing successful network logons across domain-joined workstations in Windows Security Event 4624. The analyst assumes all network logons are equally suspicious. Which specific authentication package field value in Event ID 4624 indicates NTLM-based authentication rather than Kerberos? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-06 While analyzing Windows Security Event 5145 share detail logs, an analyst spots access requests to the share `\\*\IPC$` with the target pipe `spoolss`. The analyst flags this as standard print traffic. How does access to the `spoolss` named pipe relate to coercing NTLM authentication for relay attacks? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-05 An automated threat hunting script detects user account `j.doe` generating 15 successful Type 3 NTLMSSP logons across 15 distinct servers within a 3-second window. The SOC team considers this normal SMB background scanning. What specific behavioral pattern characteristic of automated NTLM relay tools does this event burst demonstrate? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-10 During threat hunting, network traffic logs show active LLMNR/NBT-NS spoofing followed immediately by incoming SMB relay connections to HTTP and SMB services. Which specific attack tools are standard for LLMNR poisoning and NTLM relaying in Active Directory environments? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-03 During an investigation of Event ID 4624 logs, you observe a logon event where the WorkstationName field is set to 'HR-DESKTOP-01', but the IpAddress field is '192.168.1.105'. Standard DNS resolution maps 'HR-DESKTOP-01' to '192.168.1.50'. An analyst suggests ignoring this because WorkstationName is user-controlled. What key anomaly does this discrepancy represent in NTLM relay hunting? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-11 An analyst provides Windows Event ID 4769 logs showing numerous Kerberos Ticket Granting Service (TGS) requests using encryption type 0x17 (RC4-HMAC) for service principal names (SPNs) associated with service accounts. They ask you to run your NTLM relay hunting procedure on these events to identify relayed credentials. How should you respond regarding the scope of your NTLM relay analysis? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-01 You are analyzing Windows Security Event Logs to detect potential NTLM relay activity on a corporate network. An analyst suggests monitoring Event ID 4625 for failed interactive logons (Logon Type 2) as the primary indicator. What specific Windows Security Event ID and Logon Type should actually be prioritized to detect successful network logons associated with NTLM relay attacks? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-22 A security engineering team is setting up Windows Event Logging GPOs to support NTLM relay hunting. They enabled Event ID 4624. Which additional Event IDs are required to audit failed logons and detailed named pipe share access? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-15 In Windows Security Event 4624, both Kerberos and NTLM authentications generate Logon Type 3 events. What log field inside Event 4624 explicitly distinguishes the authentication mechanism by showing `Kerberos` vs `NTLM` or `NTLMSSP`? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-13 An analyst presents a memory dump containing NTLM hashes extracted via LSASS memory dumping (Sysmon Event ID 10) and asks to apply NTLM relay hunting heuristics to determine if these hashes were dumped via network relay. How should you classify this request? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-17 When auditing Windows hosts for vulnerability to SMB relay attacks, a system administrator reports that `EnableSecuritySignature` is set to `1` on all servers. Why might this host still be vulnerable to SMB relay attacks unless `RequireSecuritySignature` is also set to `1`? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-21 When producing the structured JSON report for an NTLM relay hunting assessment, where and how should the MITRE ATT&CK framework reference be structured in the JSON output? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-19 An automated threat hunting query aggregates Event ID 4624 Type 3 logons by `TargetUserName`. What time threshold pattern between logons across multiple target IP addresses strongly signals automated relay tool activity rather than legitimate user activity? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-16 An attacker relays authentication from client `HOST-A` (`10.1.1.50`) to target server `HOST-B` (`10.1.1.100`) using a relay utility on `10.1.1.200`. In the resulting Event 4624 on `HOST-B`, what entity's identity is reflected in `WorkstationName`, and what entity's identity appears in `IpAddress`? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-23 When investigating an NTLM relay incident, an analyst finds evidence of LLMNR and NBT-NS broadcast resolution requests being answered by an unauthorized host. What initial attack technique facilitated the capture of the NTLM authentication before it was relayed? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-07 In Windows Security Event 5145, an investigator spots remote connections to named pipe `lsarpc` from a workstation IP that does not belong to a domain controller or administrative host. What specific threat vector does this named pipe access indicate in NTLM relay hunting? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-08 An infrastructure audit reveals that several internal file servers have SMB Signing set to Enabled but not Required. An engineer argues that having signing enabled without forcing it is sufficient security against credential relay. Why is SMB signing configuration critical to audit when mitigating NTLM relay attacks? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-09 A SOC team is documenting an NTLM relay detection rule in their SIEM and needs to associate it with the precise MITRE ATT&CK sub-technique for Adversary-in-the-Middle via LLMNR/NBT-NS or NTLM relay. Which MITRE ATT&CK ID should be assigned to this technique? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-12 A SIEM rule fires on Windows Security Event ID 4662 where a non-domain-controller account requests extended rights `DS-Replication-Get-Changes` against the domain partition root. The analyst asks to evaluate this using NTLM relay IP-hostname mismatch rules. How should this request be handled? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-14 When reviewing Event ID 5145 logs to hunt for NTLM relay exploitation, an analyst wants to filter for named pipe connections. Which specific log field in Event ID 5145 contains the named pipe target string (such as `lsarpc` or `spoolss`)? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-18 In an Active Directory environment, computer account `WORKSTATION01$` authenticates to a server from IP `192.168.5.22` (which belongs to a developer subnet, while `WORKSTATION01` is on `10.2.2.10`). Why does this trigger a machine account relay alert? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-20 You are generating the JSON summary report for an NTLM relay threat hunt as specified in the standard detection procedure. What key section or field must be included in the output JSON report to hold the list of detected suspicious authentication events? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |