ATT&CK T1187 - SMB NTLM Relay Attack Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects potential NTLM Relay attacks over SMB. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, and within that traffic, it identifies the presence of both the SMB protocol signature ('|FF|SMB') and the NTLMSSP (NTLM Security Support Provider) signature. This combination suggests an attempt to relay NTLM authentication.