NTLM Relay Tool Usage via Responder or Inveigh Detected
Detects the execution of known LLMNR, NBT-NS, and SMB relaying tools such as Responder, Inveigh, and MultiRelay, or the use of their specific command-line arguments, which are commonly used by adversaries for adversary-in-the-middle attacks to capture or relay authentication material.
Microsoft Sentinel (KQL)
