Identity & Access
NTLM Authentication
Also known as: NTLM, NT LAN Manager
Definition
A legacy Windows challenge-response authentication protocol that proves a user's identity from a stored password hash, now considered weak by modern standards.
Examples
- An attacker capturing NTLMv2 hashes via a rogue SMB server and cracking them offline with hashcat.
- NTLM relay through an unsigned SMB session to authenticate to a domain controller.
Related terms
Kerberos
A ticket-based network authentication protocol that uses symmetric cryptography and a trusted Key Distribution Center to enable secure single sign-on across services.
Active Directory
Active Directory — definition coming soon.
Authentication
The process of verifying that an entity — user, device or service — really is who or what it claims to be before granting access.
Password
Password — definition coming soon.
Rainbow Table Attack
A precomputation attack that uses chains of hash and reduction functions stored in a compact table to invert unsalted password hashes much faster than brute force.
Credential Stealer
Malware focused specifically on extracting passwords, hashes, and authentication tokens from an infected system or its memory.