NTLM Relay: When Windows Trust Becomes an Attack Path

Aegiron 6 mins0

1. NTLM

NTLM (NT LAN Manager) is a challenge–response authentication protocol used by Windows systems when Kerberos cannot be used.

At a protocol level, NTLM works like this:

  1. Client requests access to a service
  2. Server sends a random challenge
  3. Client calculates a response using:
    • The challenge
    • A secret derived from the user’s password
  4. Server validates the response

Important technical facts:

  • The password is never sent
  • The response is valid only for that challenge
  • NTLM does not cryptographically bind the authentication to the target service
  • NTLM does not verify server identity

Those last two points are what make NTLM Relay possible.

2. What “relay” means in protocol terms

A relay attack means:

The attacker sits between two systems and forwards authentication messages unchanged in real time.

In NTLM Relay:

  • The attacker does not modify the authentication
  • The attacker does not decrypt anything
  • The attacker simply forwards messages between:
    • Victim → Attacker
    • Attacker → Target service

Because NTLM does not confirm who the client is talking to, the target service accepts the forwarded authentication as legitimate.

3. Why NTLM Relay is fundamentally possible

Core design limitations

NTLM assumes:

  • The network is trusted
  • The server is legitimate
  • Authentication happens directly

Modern networks violate all three assumptions.

4. Technical NTLM Relay flow

  1. Victim initiates NTLM authentication
  2. Attacker receives NTLM challenge/response
  3. Attacker forwards challenge/response to target
  4. Target validates response
  5. Target grants access as the victim

Key point:

  • Authentication succeeds without attacker credentials
  • The victim remains unaware

5. Authentication coercion (how victims are triggered)

Victims usually authenticate without realizing it.

Common technical triggers:

  • Name resolution fallbacks (LLMNR / NBT-NS)
  • SMB or HTTP requests to attacker-controlled hosts
  • Automatic Windows service authentication
  • Embedded UNC paths or internal references

From the OS perspective:

“I need to authenticate to access this resource.”

There is no prompt because the OS believes it is talking to a trusted internal service.

6. Why NTLM Relay is more dangerous than password theft

Relay attacks abuse trust, not secrets.

7. What services are most often abused

High-risk relay targets

The risk increases dramatically if:

  • NTLM is accepted
  • Signing or binding is not enforced

8. NTLM Relay + Privilege Escalation

Relay alone gives the same privileges as the victim.

Escalation happens when:

  • The victim is an admin
  • The target service grants elevated access
  • Certificates are issued with excessive permissions
  • Relayed access allows account or group modification

This is why NTLM Relay is often chained with:

  • Lateral movement
  • Persistence techniques
  • Certificate abuse

9. Detection strategy

What defenders should question

Instead of:

“Did NTLM Relay happen?”

Ask:

“Why is NTLM being used here at this time?”

Detection angles

Authentication anomalies

  • NTLM used instead of Kerberos
  • NTLM auth to sensitive servers
  • Auth paths that don’t match network design

Network anomalies

  • SMB or HTTP authentication between endpoints that normally don’t communicate
  • Authentication crossing unexpected subnets

Behavioral anomalies

  • Access without corresponding user activity
  • Same identity authenticating to multiple services simultaneously

10. Red Flags

11. Green Flags

12. NTLM Relay vs similar techniques

13. MITRE ATT&CK Mapping

14. Hardening approach

Step 1: Visibility

  • Log NTLM usage
  • Identify where NTLM is still required

Step 2: Restriction

  • Limit NTLM to specific systems
  • Block NTLM on sensitive servers

Step 3: Enforcement

  • Enforce SMB signing
  • Enable extended protection
  • Harden certificate enrollment

Step 4: Elimination

  • Migrate to Kerberos or modern authentication
  • Remove legacy dependencies

15. NTLM Relay Cheat Sheet

What It Is

Live forwarding of NTLM authentication to impersonate a user

Why It Works

NTLM does not bind authentication to a specific server

What It Exploits

  • Legacy trust
  • Automatic authentication
  • Weak protocol binding

Best Defense

Eliminate NTLM or enforce protections that make relays impossible

16. Final technical takeaway

NTLM Relay is not clever hacking — it is protocol abuse.

  1. If NTLM is allowed – Trust can be stolen
  2. If NTLM is removed or restricted – The attack has nowhere to exist

Aegiron

Backed by 11+ years in cybersecurity and incident response, we decode the latest threats shaping today’s digital battlefield. This blog cuts through the noise with clear insights on vulnerabilities, emerging exploits, and the cyber news defenders can’t afford to miss.