NTLM relay captures an authentication attempt, often coerced from a server with PetitPotam or the printer bug, and replays it to a target that does not require signing. Because the credential is valid, the logon succeeds. The giveaway is the mismatch between who the logon claims to be and where it actually came from.
Signals at a Glance
| Signal | Where | ATT&CK |
|---|---|---|
| 4624 type 3 NTLM where WorkstationName and source IP disagree | Security 4624 | T1557.001 |
| Machine account (ends in $) NTLM logon from a host that is not that machine | Security 4624 | T1557.001 |
| One source IP authenticating to many servers within minutes | Security 4624 | T1557.001 |
| IPC$ access to lsarpc, efsrpc, spoolss or netdfs from an odd client | Security 5145 | T1187 |
| NTLM still allowed where SMB or LDAP signing is not required | Config audit | T1557.001 |
Source and Identity Mismatch
Event ID 4624 records the claimed workstation name and the network address. For a machine account, the two must agree with your asset inventory. A relay server forwarding a domain controller’s authentication shows DC01$ arriving from the attacker’s IP. Keep a lookup of hostname to IP and flag the disagreement:
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624
Logon_Type=3 Authentication_Package=NTLM
| lookup asset_inventory hostname AS Workstation_Name OUTPUT ip AS expected_ip
| where isnotnull(expected_ip) AND expected_ip!=Source_Network_Address
| where NOT cidrmatch("127.0.0.0/8", Source_Network_Address)
| stats count dc(host) AS targets values(host) AS hosts
by Account_Name, Workstation_Name, Source_Network_Address
| where match(Account_Name, "\\$$") OR targets >= 5
# tune/validate: asset_inventory must carry current DHCP and NAT mappings;
# VPN pools and multi-homed servers are the main noise.
Relay also depends on coercion. The coercion tools reach well-known RPC pipes over the IPC$ share, so the following rule watches those pipes. These pipes are used legitimately, so scope it to non-admin clients and servers that should never be coerced:
title: Possible Authentication Coercion via RPC Pipes on IPC$
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 5145
ShareName|endswith: '\IPC$'
RelativeTargetName:
- 'efsrpc'
- 'lsarpc'
- 'spoolss'
- 'netdfs'
filter_admin_hosts:
IpAddress:
- '10.0.5.10' # tune/validate: management and backup servers
condition: selection and not filter_admin_hosts
level: medium
Close the Door Rather Than Chase Logons
Relay detection is imperfect, so reduce what a relay can reach. The controls are well documented and mostly configuration:
- Require SMB signing everywhere and LDAP signing plus channel binding on Domain Controllers.
- Turn on Extended Protection for Authentication for IIS-hosted services, including AD CS web enrollment.
- Disable the Print Spooler on Domain Controllers and restrict the EFS and DFS RPC surface where it is not needed.
- Enable NTLM auditing (the NTLM Operational log) to find and then retire remaining NTLM use; block NTLM for privileged accounts through the Protected Users group.
Use the SigmaHQ and Elastic coercion rules, the Splunk ESCU NTLM analytics and Microsoft’s NTLM, SMB signing and LDAP channel-binding hardening guidance. Baseline your own environment — NAT, VPN concentrators and load balancers make source-IP mismatches common, and each needs a documented exception.
Build Detections That Fire
Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.
- Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
- Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
- 24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts