Skill UI

Analyzes Windows Security EVTX logs to detect Kerberos golden ticket assaults by correlating event IDs 4768, 4624, and 4672, flagging long-lived TGTs, privilege escalations without group changes, SID inconsistencies, and outputting a timeline-based report.

This skill provides advanced threat hunting capabilities to detect NTLM relay attacks within Active Directory environments. It analyzes critical Windows Security Event 4624 logs, specifically focusing on logon type 3 using NTLMSSP authentication. The detection logic identifies suspicious patterns, including IP-to-hostname mismatches, rapid multi-host authentications, and lack of SMB signing enforcement, helping SOC analysts pinpoint unauthorized credential access attempts.