SMB Relay Attack NTLM Hash Capture
This rule detects potential SMB Relay attacks attempting to capture NTLM hashes. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, where the flow is established and contains both "NTLMSSP" and "NTLMSSP_AUTH" content. A threshold of 3 occurrences within 30 seconds from the same source IP is set to reduce false positives.
Suricata
