Remove backed-up duplicate skills to fix validation pipeline

skills/hunting-for-ntlm-relay-attacks/SKILL.md

@@ -15,6 +15,14 @@ license: Apache-2.0
 
 NTLM relay attacks intercept and forward NTLM authentication messages to gain unauthorized access to network resources. Attackers use tools like Responder for LLMNR/NBT-NS poisoning and ntlmrelayx for credential relay. This skill detects relay activity by querying Windows Security Event 4624 (successful logon) for type 3 network logons with NTLMSSP authentication, identifying mismatches between WorkstationName and source IpAddress, detecting rapid multi-host authentication from single accounts, and auditing SMB signing configuration across domain hosts.
 
+
+## When to Use
+
+- When investigating security incidents that require hunting for ntlm relay attacks
+- When building detection rules or threat hunting queries for this domain
+- When SOC analysts need structured procedures for this analysis type
+- When validating security monitoring coverage for related attack techniques
+
 ## Prerequisites
 
 - Python 3.9+ with Windows Event Log access or exported logs