CVE-2026-24294 Impacket ntlmrelayx NTLM Relay Tool Execution
Detects the execution of known Impacket relay tools such as ntlmrelayx and smbrelayx, which are commonly used by adversaries to perform NTLM relay attacks to gain unauthorized access or execute code on remote systems.
Microsoft Sentinel (KQL)
