SMB Signing: authentication & relay attack defense

SMB signing is a security mechanism built into the SMB protocol that enforces cryptographic authentication on every SMB session packet. Each message exchanged between client and server is signed using a session key derived from the authentication exchange, ensuring both integrity and origin verification. When SMB signing is disabled or not required, an attacker positioned on the same network segment can intercept SMB traffic and relay captured NTLM credentials to authenticate against another host, without ever cracking the hash. This technique, known as NTLM relay, allows privilege escalation or lateral movement across Active Directory environments. SMB signing is therefore a foundational control against a broad class of man-in-the-middle attacks. Microsoft enforces SMB signing by default on Domain Controllers but leaves it optional on workstations and member servers, creating a widely exploitable gap in most enterprise networks. The distinction between 'signing required' and 'signing enabled' is critical: 'enabled' only means the host will accept signed sessions if the peer requests it, while 'required' forces signing on all connections.

Detecting SMB signing misconfigurations starts with Group Policy auditing. The relevant settings live under Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options: 'Microsoft network client: Digitally sign communications (always)' and its server-side counterpart. Event ID 3000 and related SMB server events can surface signing negotiation failures in verbose logging. Network-level detection relies on packet capture: Wireshark or Zeek can inspect the SMB2 NEGOTIATE response and flag sessions where SecurityMode does not include the signing required bit (bit 1 of the SecurityMode field). Tools like CrackMapExec with the '--gen-relay-list' flag enumerate hosts that do not require signing across an entire subnet in seconds. SIEM rules should alert on SMB connections to Domain Controllers from hosts that failed signing negotiation. Additionally, monitoring for anomalous NTLM authentication events (Event ID 4624 with logon type 3) originating from unexpected source IPs can reveal active relay activity already in progress.

From a Red Team perspective, SMB signing disabled on target hosts is a prerequisite for NTLM relay attacks. The classic kill chain involves Responder poisoning LLMNR or NBT-NS traffic to capture Net-NTLMv2 hashes, then piping them directly into ntlmrelayx (from the impacket suite) to authenticate against hosts where signing is not required. ntlmrelayx can dump the SAM database, execute commands via SMBExec, or create new local administrator accounts. PetitPotam and PrinterBug are coercion primitives that force machine account authentication, feeding high-privilege hashes into the relay chain without waiting for organic user traffic. Against environments where signing is enforced everywhere, these relay chains break entirely. Hardening requires setting 'Require signing' via GPO on all hosts, not just Domain Controllers. Complementary controls include enabling LDAP signing and channel binding (to block LDAP relay), disabling LLMNR and NBT-NS via GPO, and deploying network segmentation to limit lateral reachability. SMB signing enforcement should be validated regularly using CrackMapExec or Nmap's smb2-security-mode script as part of continuous exposure management.