diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/behavblockcontain-ntlmrelay.png b/windows/security/threat-protection/microsoft-defender-atp/images/behavblockcontain-ntlmrelay.png
new file mode 100644
index 0000000000..e0caf29a74
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/behavblockcontain-ntlmrelay.png differ