NTLM Relay Attack.

An adversary-in-the-middle attack (MITRE T1557.001) in which an attacker forwards a victim's NTLM authentication to another service to impersonate them without ever knowing the password. It belongs to the Attacks & Threats category of cybersecurity.

An adversary-in-the-middle attack (MITRE T1557.001) in which an attacker forwards a victim's NTLM authentication to another service to impersonate them without ever knowing the password.

An NTLM relay attack abuses the challenge-response design of NTLM authentication. The attacker tricks a victim host into authenticating to attacker-controlled infrastructure (for example via WebDAV, file-share UNC paths, or PetitPotam-style coercion), then forwards the victim's NTLM messages to a target service such as LDAP, SMB, ADCS web enrollment, or MSSQL. The target accepts the legitimate challenge response and grants the attacker access in the victim's identity. Because no cleartext password or hash is recovered, only signed and bound protocols stop it. Mitigations include enforcing SMB signing, LDAP signing and channel binding (EPA), disabling NTLM where possible, and patching coercion vectors. Impacket's ntlmrelayx is the canonical tool.

Defences for NTLM Relay Attack typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: NTLM relaying, T1557.001.