NTLM Relay
Study how captured NTLM authentication can be relayed to another service when signing, channel binding, and protocol protections are absent.
Study how captured NTLM authentication can be relayed to another service when signing, channel binding, and protocol protections are absent.
Requirements
- A coercible or captured authentication flow
- A compatible target service
- Missing or insufficient relay protections
Detection
- Correlate unusual authentication source and destination pairs
- Monitor name-resolution poisoning and coercion indicators
Remediation
- Require SMB and LDAP signing where supported
- Enable channel binding and reduce NTLM usage