What is an NTLM relay attack?

An NTLM relay attack forwards NTLM authentication captured from one host to another service that does not enforce signing or channel binding. Attackers coerce a target to authenticate (using PetitPotam, PrinterBug or Coercer) or poison name resolution with Responder, then relay that authentication to SMB, LDAP or AD CS web enrolment (the ESC8 path) to escalate privilege or take over a domain. It maps to MITRE ATT&CK T1187 and T1557.001. Enforcing SMB/LDAP signing, EPA and disabling NTLM are the core defences.

NTLM Relay: Turning Forced Authentication Into Domain Takeover

NTLM relay abuses a design weakness: NTLM is a challenge-response protocol with no channel binding by default, so an authentication to one service can be forwarded (“relayed”) to another where signing or Extended Protection is not enforced. Attackers pair it with coercion — forcing a target host to authenticate to an attacker-controlled listener — and relay that authentication onward to SMB (for admin/code execution), LDAP (to grant rights such as RBCD or Shadow Credentials), or the AD CS web-enrolment endpoint (the SpecterOps-named “ESC8” path) to mint a certificate and authenticate as the coerced machine. It is a staple of red-team and intrusion privilege escalation.

Coerce, Then Relay

The attacker first coerces authentication — via MS-RPRN (PrinterBug/SpoolSample), MS-EFSRPC (PetitPotam), or multi-protocol coercion (Coercer) — or poisons name resolution (LLMNR/NBT-NS) with Responder to capture it. The captured NTLM authentication is then relayed to a service that does not enforce signing. Relayed to LDAP, it can configure resource-based constrained delegation or add Shadow Credentials; relayed to AD CS HTTP enrolment, it yields a certificate the attacker converts into a Kerberos TGT or NT hash. T1187 T1557.001

ESC8 note

“ESC8” (relay to AD CS web enrolment) is SpecterOps analyst terminology, not a MITRE ATT&CK ID. ATT&CK has no dedicated AD CS-relay technique.

Tooling

Impacket’s ntlmrelayx.py is the relay engine (including an AD CS mode); PetitPotam, SpoolSample/printerbug and Coercer drive coercion; Responder poisons LLMNR/NBT-NS to capture authentication; Certipy and PKINITtools convert a relayed certificate into usable credentials.

MITRE ATT&CK Mapping

Tactic	Technique	Usage
Credential Access	T1187 Forced Authentication	PetitPotam/PrinterBug coercion
Credential Access / Collection	T1557.001 LLMNR/NBT-NS & SMB Relay	Relay engine
Credential Access	T1649 Steal or Forge Auth Certificates	Relay to AD CS (ESC8)

Detection & Mitigation

Enforce SMB signing and LDAP signing with LDAP channel binding domain-wide; enable Extended Protection for Authentication (EPA) on AD CS web enrolment and other HTTP/LDAPS endpoints.
Disable NTLM where feasible; require HTTPS and EPA for AD CS enrolment or remove the web-enrolment role; patch EFSRPC/PrinterBug coercion vectors.
Disable LLMNR/NBT-NS and the Print Spooler on servers and DCs that do not need them.
Detect machine-account authentications to the CA, certificate requests for machine accounts, and NTLM authentication arriving at servers from unexpected hosts.

Harden Active Directory Authentication

Mjolnir Security helps organisations close NTLM relay and coercion paths across their AD estate.

Active Directory SecurityPenetration TestingManaged Detection & ResponseIncident ResponseThreat Hunting

Active Directory Security Review Enforcing SMB/LDAP signing, EPA and NTLM reduction.
Penetration Testing Validating coercion and relay exposure end to end.
24/7 Incident Response Containment when domain takeover is suspected. Call +1 833 403 5875.

Written by: Mjolnir Security  |  Published: October 12, 2026

Coerce, Then Relay

Tooling

MITRE ATT&CK Mapping

Detection & Mitigation

Harden Active Directory Authentication

AD CS Abuse

Impacket