What Is NTLM Relay?

NTLM relay is an attack where an adversary intercepts an NTLM authentication attempt and relays it to another server, authenticating as the victim without knowing their password.

How It Works

Victim ──[NTLM auth]──> Attacker ──[relayed auth]──> Target Server

                          ↑


               (captures & forwards credentials)

  1. Attacker triggers victim to authenticate to their server (via phishing, printer misconfiguration, LLMNR poisoning, etc.)
  2. Attacker relays the NTLM exchange to a target server
  3. Target server authenticates the attacker as the victim
  4. Attacker now has authenticated access to the target

Common Trigger Methods

MethodHow It Works
LLMNR/NBT-NS PoisoningRespond to broadcast name resolution queries
PDF/URL filesEmbed UNC path triggering auto-auth
.library-ms filesCVE-2025-24054 pattern
Printer Bug (SpoolSS)Force domain controllers to authenticate
WebDAV coercionTrigger via WebClient service

Prevention Checklist

High Priority (Do These Now)

  • [ ] Enable SMB signing on all machines via GPO: Microsoft network server: Digitally sign communications (always) = Enabled
  • [ ] Enable LDAP signing and channel binding on all DCs
  • [ ] Disable LLMNR via GPO: Computer Config > Admin Templates > Network > DNS Client > Turn off multicast name resolution
  • [ ] Disable NBT-NS via DHCP options or GPO

Medium Priority

  • [ ] Enable Extended Protection for Authentication (EPA) on Exchange/IIS
  • [ ] Enforce Kerberos-only authentication for sensitive services
  • [ ] Disable WebClient service on non-required systems
  • [ ] Block outbound SMB (TCP 445) at network perimeter

Detection

  • Monitor for Event ID 4624 (Logon Type 3) with NTLM authentication from unexpected hosts
  • Deploy Responder/Inveigh in detection-only mode for baseline
  • Alert on NTLM authentication to domain controllers from workstations