NTLM Relay Attempt
Detects NTLM successful network logons where the source and destination workstations are the same, excluding loopback addresses. This behavior can be indicative of NTLM relay attacks where an attacker relays authentication from a victim to the victim's own machine, or other forms of NTLM abuse.
YARA-L
