T1557.001Credential AccessAdvanced

NTLM Authentication Attacks: From Pass-the-Hash, NTLM Relay, and Forced Authentication to LLMNR/NBT-NS Poisoning

HARDEC · Savunma Güvenliği Ekibi·Published: June 13, 2026·Updated: July 15, 2026·15 min read

A comprehensive map of attacks targeting NTLM authentication in on-premises Active Directory environments: LLMNR/NBT-NS poisoning and NetNTLM hash harvesting (Responder), forced authentication (PetitPotam MS-EFSRPC/CVE-2021-36942, PrinterBug MS-RPRN, DFSCoerce MS-DFSNM, ShadowCoerce), NTLM relay (SMB→LDAP/LDAPS/ADCS ntlmrelayx chain), Pass-the-Hash, NTLMv1 downgrade, and countermeasures (SMB signing, EPA, LDAP channel binding, Protected Users, mitm6). The detection-prevention triad for SOC, DFIR, and red/purple teams.

Active exploitation warning

The following vulnerabilities referenced in this content are under active exploitation in the CISA KEV catalog:

CVE-2021-36942EPSS %66· ransomware

Source: CISA KEV ·

Exploit

Prevention

Detection

Defense profile:3 detection rules 11 mitigations 32 baseline controls 2 response playbooks

Swipe or use the arrows to move between sections

Section 1 / 3

Zafiyet (Vulnerability)

Tehdit bağlamı, zafiyet ve istismar senaryosu

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Section 2 / 3

Prevention & Hardening

Savunma teknolojileri, policy ve sertleştirme

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Section 3 / 3

Detection

Davranış, loglama ve detection kuralları

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Information note

Prevention and detection: The primary countermeasure against LLMNR/NBT-NS poisoning attacks is disabling these protocols via Group Policy. To block NTLM relay, SMB signing and LDAP channel binding must be enforced; if IPv6 is not in use, it should be fully blocked on the network or DHCPv6 disabled. For Pass-the-Hash detection, successful logon attempts to different systems within a short time using the same user hash should be flagged as anomalous. A common mistake is failing to notice that NTLMv1 is still active (MITRE ATT&CK T1557.001).

Detection rules

Directly copyable rules (Sigma/KQL/…) that detect this technique. Each rule specifies its required telemetry, maturity, and source.

Potential SMB Relay Attack Tool Execution

Detects different hacktools used for relay attacks on Windows for privilege escalation

critical

sigmaTest

Show ruleHide rule

title: Potential SMB Relay Attack Tool Execution
id: 5589ab4f-a767-433c-961d-c91f3f704db1
status: test
description: Detects different hacktools used for relay attacks on Windows for privilege escalation
references:
    - https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/
    - https://pentestlab.blog/2017/04/13/hot-potato/
    - https://github.com/ohpe/juicy-potato
    - https://hunter2.gitbook.io/darthsidious/other/war-stories/domain-admin-in-30-minutes
    - https://hunter2.gitbook.io/darthsidious/execution/responder-with-ntlm-relay-and-empire
    - https://www.localpotato.com/
author: Florian Roth (Nextron Systems)
date: 2021-07-24
modified: 2023-02-14
tags:
    - attack.collection
    - attack.execution
    - attack.credential-access
    - attack.t1557.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_pe:
        Image|contains:
            - 'PetitPotam'
            - 'RottenPotato'
            - 'HotPotato'
            - 'JuicyPotato'
            - '\just_dce_'
            - 'Juicy Potato'
            - '\temp\rot.exe'
            - '\Potato.exe'
            - '\SpoolSample.exe'
            - '\Responder.exe'
            - '\smbrelayx'
            - '\ntlmrelayx'
            - '\LocalPotato'
    selection_script:
        CommandLine|contains:
            - 'Invoke-Tater'
            - ' smbrelay'
            - ' ntlmrelay'
            - 'cme smb '
            - ' /ntlm:NTLMhash '
            - 'Invoke-PetitPotam'
            - '.exe -t * -p '  # JuicyPotatoNG pattern https://github.com/antonioCoco/JuicyPotatoNG
    selection_juicypotato_enum:  # appears when JuicyPotatoNG is used with -b
        CommandLine|contains: '.exe -c "{'
        CommandLine|endswith: '}" -z'
    filter_hotpotatoes:  # known goodware https://hotpot.uvic.ca/
        Image|contains:
            - 'HotPotatoes6'
            - 'HotPotatoes7'
            - 'HotPotatoes ' # Covers the following: 'HotPotatoes 6', 'HotPotatoes 7', 'HotPotatoes Help', 'HotPotatoes Tutorial'
    condition: 1 of selection_* and not 1 of filter_*
falsepositives:
    - Legitimate files with these rare hacktool names
level: critical

Not validated

Telemetry required to run: windows; Process Creation Eventswindows / process_creationwindows

False positive: Legitimate files with these rare hacktool names

Source: SIGMA · Detection Rule License (DRL) 1.1 · original rule

Mitigations

Prevention and hardening measures that mitigate or block this technique.

Credential Access Protection

Prevention

Layered platform protections that reduce theft of in-memory and on-disk credentials (LSASS, Protected Users, WDigest, cache).

Information note

Informational note: Windows Credential Guard runs the LSA process in a virtualization-based security (VBS) enclave, preventing hash and token theft from LSASS memory; however, older CPUs and some virtualization configurations may not be supported. As additional measures, LSA Protected Process (PPL) should be enabled, unnecessary privileges (SeDebugPrivilege) removed, and LSASS access attempts monitored with Sysmon EID 10.

Disable or Remove Feature or Program

Hardening

Remove unnecessary/legacy features: SMBv1, LLMNR/NBT-NS, unused services.

Information note

Informational note: In the mitigation of disabling features and programs, disabling attack-exposed protocols such as LLMNR, NetBIOS-NS, NTLMv1, Wpad automatic proxy discovery, and unused IPv6 are top priorities. On Linux systems, unnecessary daemons should be removed; on network devices, legacy services (bootp, fingerd) should be disabled. Removing PowerShell v2 renders download cradle and obfuscation techniques less effective.

Baseline controls against this technique

The following security baseline controls mitigate this technique. Compare your organization's configuration against the relevant baseline by .

Response playbooks

NIST/SANS phase-based response workflows to follow when this technique is detected.

Techniques in the Credential Access tactic

T1003.001Credential AccessAdvanced

A comprehensive map of NT hash, Kerberos ticket, and plaintext password theft via memory dumping of Windows authentication backbone LSASS (lsass.exe): Mimikatz/sekurlsa, comsvcs LOLBin, ProcDump, and nanodump attack methods; Sysmon EID 10 GrantedAccess masks + Sigma-based technical detection; Credential Guard, RunAsPPL, WDigest disable, and ASR rule hardening controls.

June 13, 202631 min read

Exploit

Prevention

Detection

References

MITRE ATT&CK — T1557.001: NTLM Authentication Attacks: From Pass-the-Hash, NTLM Relay, and Forced Authentication to LLMNR/NBT-NS Poisoning ↗

This article is based on the MITRE ATT&CK framework; the detection, defense, and response content was prepared independently.

title: Tek IP Adresinden Coklu Hesaba NTLM Ag Girisi (Relay/Poisoning Deseni) id: b8d4e3f2-91c6-4e0b-ad5f-6a2c3b7d8e15 status: experimental description: | Tek bir kaynak IP adresinden kisa sure icerisinde farkli kullanici hesaplarinin NTLM ag kimlik dogrulamasi ile giri yaptigini tespit eder. Bu desen Responder veya Inveigh gibi LLMNR/NBT-NS zehirleme araclarinin relay saldirisini gosterir: kurbanlarin NTLM kimlik bilgileri toplanip farkli hedeflere aktarilir. Kural AI tarafindan uretilmis / dogrulanmamistir. references: - https://attack.mitre.org/techniques/T1557/001/ - https://github.com/lgandx/Responder - https://github.com/Kevin-Robertson/Inveigh - https://www.sans.org/white-papers/36297/ author: CyberSecLab (AI) date: 2026-06-13 modified: 2026-06-13 tags: - attack.t1557.001 - attack.credential_access - attack.collection logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 3 AuthenticationPackageName: 'NTLM' filter_local_loopback: IpAddress: - '127.0.0.1' - '::1' - '-' filter_machine_account: TargetUserName|endswith: '$' condition: selection and not 1 of filter_* timeframe: 10m aggregation: type: count group-by: - IpAddress condition: count(TargetUserName) >= 8 falsepositives: - Toplu kimlik dogrulama yapan uygulamalar veya servisler (SCCM, yazilim dagitim sistemleri) - VPN aggeceleri veya proxy sunucular - Kullanicilarin yogun oldugu terminal sunuculari level: high

title: NTLMv1 veya LM Kimlik Dogrulama Protokolu Kullanimi id: a3f7c2e1-84b5-4d9a-bc3e-5f1d2a8e6074 status: experimental description: | Agdaki bir kaynaktan NTLMv1 veya LM kimlik dogrulama protokolunun kullanildigini tespit eder. Bu eski protokoller NTLM relay saldirilari (T1557.001) ve Responder/ Inveigh gibi araclarla kolayca ele gecirilip kiriliabilir. Uretim aglarinda NTLMv1/LM kullanimi anormal kabul edilmeli ve incelenmelidir. Kural AI tarafindan uretilmis / dogrulanmamistir. references: - https://attack.mitre.org/techniques/T1557/001/ - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624 - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_ntlm_v1_enabled.yml - https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-148a author: CyberSecLab (AI) date: 2026-06-13 modified: 2026-06-13 tags: - attack.t1557.001 - attack.credential_access - attack.collection logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 3 AuthenticationPackageName: 'NTLM' LmPackageName: - 'NTLM V1' - 'LM' filter_local: IpAddress: - '127.0.0.1' - '::1' - '-' filter_machine_local: TargetUserName|endswith: '$' IpAddress: '127.0.0.1' condition: selection and not 1 of filter_* falsepositives: - Eski isletim sistemi veya yazicilara sahip ortamlar (Windows XP, Server 2003 era cihazlar) - Bazi eski uygulama sunuculari NTLMv1 kullanabilir - Test ortamlari level: high

NTLM Authentication Attacks: From Pass-the-Hash, NTLM Relay, and Forced Authentication to LLMNR/NBT-NS Poisoning

Active exploitation warning

Zafiyet (Vulnerability)

This section is not open yet

Prevention & Hardening

This section is not open yet

Detection

This section is not open yet

Detection rules

Potential SMB Relay Attack Tool Execution

Mitigations

Credential Access Protection

Disable or Remove Feature or Program

Baseline controls against this technique

Response playbooks

Techniques in the Credential Access tactic

References

High-Volume NTLM Network Logons from Single Source (Responder/Inveigh Pattern)

NTLMv1/LM Authentication Usage

Encrypt Sensitive Information

Filter Network Traffic

Limit Access to Resource Over Network

Network Access Control (NAC / 802.1X)

Network Intrusion Prevention

Network Segmentation

PowerShell Constrained Language Mode

SMB Signing and NTLM Relay Prevention

User Training

Kerberos Ticket Attacks: From Kerberoasting to Ticket Forgery

Microsoft Graph API and Permission Abuse: Illicit Consent, Application Roles, and OAuth Attacks

Active NTLM Relay / Pass-the-Hash / Coercion Response

NTLM Hash Harvesting (LLMNR/NBT-NS Poisoning and NTLMv1 Downgrade) Response