Got this tidbit from here, but basically if you add --output-file to your ntlmrelayx command, you'll log all the users who had hashes related. The tweet author notes to be careful as the unsuccessful attempts are also relayed.
Announcement
Collapse
No announcement yet.
Log all relayed ntlmrelayx credentials
Collapse