GPTsApp SkillsCodex Reset
Menu
← Back to results

skill collection · Study the method

detecting-ntlm-relay-with-event-correlation

Detect NTLM relay attacks through Windows Security Event correlation by analyzing Event 4624 LogonType 3 for IP-to-hostname mismatches, identifying Responder/LLMNR poisoning artifacts,

SKILL.md metadata excerpt. This is the source’s description, not an instruction to this site.

byhartvig/agent-skills-collectiondevelopment-and-testing/cybersecurity-skills/detecting-ntlm-relay-with-event-correlation/SKILL.md

Before you use it

Input
Not independently summarized. Check the source’s scope and examples.
Expected output
Not independently summarized; do not assume a ready-to-use artifact.
Prerequisites
Review the source instructions, scripts, accounts and tools in your intended environment.

Installation guidance is not individually established for this example. Read the source and confirm its requirements.

Publisher documentation, static file observations and environment tests are different kinds of evidence. Runtime behavior has not been observed.

Study the method

Start with the task scope and instructions, then inspect supporting files and examples. Compare the workflow with your own inputs, constraints and intended result.

File and folder counts are unknown, not zero.

The supporting file list has not been read for this source. Open the source directory to inspect it.

Zero files in scripts/ does not mean no execution, network access or file writes. Markdown and other folders may describe or contain executable behavior.

Source version and requirements

Observed
2026-09-12T11:15:35.101Z
Source commit
999411696fee8e046a49c52c5c0b43f4c4f63dcf
Content SHA-256
573b549d495c9a29df12d5f6fa410e9de3f22d0d0945a64da7b630bb5f6e3ef2
License
Unknown
Author attribution
Repository owner: byhartvig. Individual authorship is not independently established.

This page describes a pinned source snapshot, not the latest repository state. Changes after this commit have not been reconciled here. A repository license does not necessarily cover external models, datasets or services.

Open current repository ↗
Reference note and manual copy