NTLM Relay: attack chain and lateral movement

NTLM Relay is an attack technique that intercepts NTLM authentication exchanges and forwards them to a target server without ever cracking the underlying credential. The attack chain starts when a Windows client broadcasts a name resolution request via LLMNR, NBT-NS, or mDNS. An attacker on the local segment poisons that request and receives an NTLM challenge-response intended for a legitimate server. Instead of cracking the hash, the attacker relays it in real time to a third host, authenticating as the victim. The lateral movement potential is significant: if the relayed account holds local admin rights on the target, the attacker gains immediate code execution. NTLM Relay is relevant in Active Directory environments because Windows still supports NTLMv1 and NTLMv2 by default on many networks. Unlike Kerberos, NTLM authentication does not bind the session cryptographically to the origin channel, which is exactly what makes relay feasible. The attack requires no prior credential and succeeds silently against hosts where SMB signing is not enforced.

Detection of NTLM Relay activity requires monitoring at several layers simultaneously. On the network side, unexpected LLMNR or NBT-NS responses from non-authoritative hosts are a strong indicator. A SIEM should alert on Windows Event ID 4624 (logon type 3) combined with ID 4776 (NTLM authentication) originating from an IP address that is not the legitimate owner of the authenticating account. Event ID 4648 flags explicit-credential logons that may signal relay in progress. NetFlow or PCAP analysis can surface Responder-style ARP poisoning or abnormal SMB session establishment sequences. On endpoints, Windows Defender for Identity and Microsoft Sentinel both ship detection rules targeting NTLM relay patterns. Key IOCs include multiple failed authentications followed by a successful lateral logon within seconds, and SMB sessions opened with mismatched source and authentication account names. Network IDS signatures for Responder and ntlmrelayx tool fingerprints add another detection layer. Correlating DNS query failures with subsequent suspicious SMB connections narrows false-positive rates significantly.

Red teams execute NTLM Relay attacks using two tools in tandem. Responder poisons LLMNR and NBT-NS traffic to capture incoming authentication attempts while disabling its own SMB and HTTP servers so that ntlmrelayx can handle forwarding. The ntlmrelayx tool from the Impacket suite then relays captured credentials to selected targets. Common objectives include dumping the SAM database via secretsdump, executing commands through SMBExec or WMIExec, or creating a SOCKS proxy for deeper pivoting. LDAP relay is also viable: ntlmrelayx can relay credentials to a domain controller's LDAP interface to add a machine account or escalate privileges via Resource-Based Constrained Delegation. Hardening against NTLM Relay starts with enforcing SMB signing on all hosts via Group Policy, which breaks relay over SMB entirely. Disabling LLMNR and NBT-NS via GPO removes the poisoning vector at its root. Enabling Extended Protection for Authentication (EPA) on IIS and LDAP servers blocks HTTP and LDAP relay paths. Restricting NTLMv1 via the 'Network security: LAN Manager authentication level' policy and enabling LDAP channel binding on domain controllers are additional mandatory mitigations.