NTLM: relay attacks, hashes & exploitation

NTLM (NT LAN Manager) is a challenge-response authentication protocol developed by Microsoft. NTLM relay attacks, hashes and exploitation remain central topics in Active Directory security assessments. The protocol operates in three steps: the client sends a NEGOTIATE message, the server replies with a CHALLENGE containing a nonce, and the client returns a AUTHENTICATE message containing the NT hash of the user password XORed with that nonce. NTLM never transmits the plaintext password, but it transmits a hash derived from it, making it vulnerable to offline cracking and reuse attacks. Unlike Kerberos, NTLM does not require a domain controller to validate authentication: any machine can act as the authenticating party. This design enables relay scenarios where an attacker intercepts an authentication attempt and forwards it to a third target. NTLMv1 is considered cryptographically broken. NTLMv2 adds a client challenge and a timestamp to the server challenge, making precomputed rainbow table attacks impractical, but it remains vulnerable to relay and capture-then-crack techniques. NTLM is still widely enabled in enterprise environments for legacy compatibility, representing a persistent attack surface in modern Windows networks.

Detecting NTLM abuse requires monitoring several distinct log sources. On Windows domain controllers, Event ID 4776 records NTLM credential validation attempts, including the source workstation name and the account used. Event ID 4624 with Logon Type 3 combined with Authentication Package 'NTLM' in the logon fields indicates a network logon using NTLM instead of Kerberos. A spike in 4776 events from a single source, especially targeting multiple accounts, is a strong indicator of brute-force or relay activity. Enabling 'Audit Credential Validation' and 'Audit Logon' policies under Advanced Audit Policy Configuration is mandatory. Network-level detection should focus on SMB traffic where Negotiate Protocol Response includes NTLM Security Support Provider (NTLMSSP) signatures. Zeek (formerly Bro) can parse NTLMSSP fields from SMB and HTTP NTLM authentication flows. Responder-based attacks generate LLMNR, NBT-NS and mDNS queries visible in DNS or network capture logs. SIEM correlation rules should flag NTLM authentications to sensitive servers (domain controllers, file servers) originating from hosts that normally use Kerberos. Microsoft Defender for Identity (MDI) natively detects NTLM relay and downgrade attempts using behavioral baselines. Blocking NTLMv1 via GPO immediately reduces the noisiest detection surface.

Red team operators exploit NTLM through three primary techniques: capture, relay and Pass-the-Hash. Capture relies on tools like Responder, which poisons LLMNR and NBT-NS name resolution to trick clients into authenticating to an attacker-controlled host. The resulting NTLMv2 NetNTLM hash is then submitted to hashcat using mode 5600 for offline cracking. Relay attacks, orchestrated with ntlmrelayx from the Impacket suite, forward captured authentication to a target service without cracking the hash. When SMB signing is disabled on the target, ntlmrelayx can dump SAM databases, execute commands or create new accounts. NTLM relay over LDAP allows privilege escalation via Resource-Based Constrained Delegation (RBCD) or shadow credentials if LDAP signing is not enforced. Pass-the-Hash uses the raw NT hash extracted from LSASS memory (via Mimikatz sekurlsa::logonpasswords) to authenticate laterally without knowing the plaintext password. Hardening measures include enforcing SMB signing via GPO (Microsoft network server: Digitally sign communications always), disabling NTLMv1 through Network security LAN Manager authentication level set to 'Send NTLMv2 response only, refuse LM and NTLM', deploying LDAP signing and channel binding, and progressively restricting NTLM usage with the Restrict NTLM GPO settings to push workloads toward Kerberos.