SMB Relay Attack.

A specific NTLM relay variant in which an attacker forwards a victim's SMB authentication to another SMB server to gain code execution or file access as the victim. It belongs to the Attacks & Threats category of cybersecurity.

A specific NTLM relay variant in which an attacker forwards a victim's SMB authentication to another SMB server to gain code execution or file access as the victim.

SMB relay attacks abuse Windows file-sharing authentication when SMB signing is not enforced. The attacker positions themselves between a victim host and a target server, often by poisoning name resolution with Responder or by coercing the victim to connect to a malicious UNC path. The victim's NTLM authentication is then relayed to a target SMB server where signing is not required. If the relayed identity has local-admin rights on the target, the attacker can execute commands via PsExec-style service installation, schedule tasks, or read sensitive shares. SMB signing required on both clients and servers is the principal mitigation; LDAPS or Kerberos-only environments further reduce exposure. Impacket smbrelayx and ntlmrelayx with -t smb:// are the canonical tools.

Defences for SMB Relay Attack typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: SMB relaying, Cross-protocol SMB relay.