Spotting NTLM Relay Attacks: Early Warning Signs and Response Steps
NTLM relay attacks exploit legacy authentication protocols to escalate privileges without ever stealing the actual password hash from the network traffic.
NTLM relay attacks often manifest as unexpected service interruptions or unauthorized resource access. You will see legitimate credentials being reused at unusual endpoints. Immediate containment requires isolating affected hosts and enforcing channel binding to prevent credential reuse across different services.
The Mechanics of Credential Reuse
NTLM is an older authentication protocol used in Windows environments. It allows a client to prove its identity to a server without sending the password in plain text. The process involves a challenge-response handshake where the server sends a random number, and the client encrypts it with a hash of the password. An attacker who intercepts this handshake can act as a man in the middle. They pretend to be the server to the client and pretend to be the client to the real server. This allows them to relay the authentication request to another resource without ever knowing the actual password.
Obvious Indicators of Activity
The most visible signs involve sudden changes in access rights or service availability. Imagine a scenario where a file server suddenly denies access to its owners, or a database becomes unreachable. This happens because the attacker has hijacked the session or locked out the legitimate user by consuming their authentication token. You might also see logins occurring at odd hours from internal IP addresses that do not match typical user behavior. These events are disruptive and trigger immediate alerts from standard monitoring tools.
Subtle Signals in the Logs
More dangerous are the signs that leave little trace in standard event logs. NTLM relay attacks often target service accounts rather than interactive users. Service accounts have consistent login patterns, so a slight deviation in the target server or the time of day can be missed. Attackers frequently use this method to move laterally within the network.
They might authenticate to a domain controller or a management server to dump credentials further. Look for authentications to servers that do not normally accept interactive logins. For instance, a web server suddenly authenticating to a database server via NTLM is a red flag. This is less obvious because service accounts are expected to move around.
The Role of Channel Binding
Modern systems mitigate this risk using channel binding. This feature ties the authentication handshake to the specific TLS connection or network channel used. If an attacker tries to relay the authentication to a different service or IP address, the binding fails, and the authentication is rejected. Without channel binding, the authentication token is portable. It can be reused anywhere the attacker has network access. You should verify that channel binding is enabled on all servers that accept NTLM authentication. This includes web servers, file shares, and remote management tools.
Analyzing Network Traffic Patterns
When you suspect a relay attack, examining network traffic provides concrete evidence. You will see a three-way handshake between the victim client and the attacker, followed immediately by a similar handshake between the attacker and the target server. The timestamps will be nearly identical. This pattern is distinct from normal user behavior. Users do not typically authenticate to multiple servers in rapid succession during a single session. Packet capture analysis helps confirm these patterns. It allows you to see the exact sequence of packets and verify that the same authentication tokens are being replayed.
| Sign | What it usually means | What to do |
|---|---|---|
| Service account authenticates to unexpected host | Lateral movement via relay | Isolate the target host and reset the service account credentials |
| Rapid NTLM handshakes from single IP | Active relaying attempt | Block the source IP at the firewall and inspect for other compromised hosts |
| Channel binding errors in logs | Mitigation is working | Verify the configuration is consistent across all servers |
See also: Remote Desktop Abuse: The Step-by-Step Attack Chain
Immediate Containment Steps
When you identify a potential relay, speed is critical. First, isolate the compromised host from the network to stop further relaying. Second, reset the credentials of the account that was relayed. This invalidates any existing sessions. Third, check for new administrators or scheduled tasks on the target server. Attackers often use relayed credentials to add themselves to local admin groups. Review the security logs for any changes to user rights or group memberships. Document every step for your incident response runbooks. This documentation helps in post-incident analysis and improves future detection capabilities.
Preventing Future Exploitation
Prevention relies on reducing the attack surface. Disable NTLM where possible and enforce Kerberos authentication instead. Kerberos is more secure and does not suffer from the same relaying vulnerabilities. For systems that must use NTLM, enforce signature requirements. This adds a layer of integrity to the authentication process. Regularly audit service account permissions. Ensure they have only the minimum access required for their function. Adversary emulation can help test your defenses. By simulating these attacks, you can verify that your detection rules and mitigation controls are effective.
Key takeaways
- Attackers do not need the password; they reuse the authentication handshake itself.
- Service account usage patterns often reveal relay activity before human accounts are compromised.
- Channel binding and signature requirements are the primary technical controls to stop relaying.
NTLM relay attacks exploit the portability of authentication tokens rather than stealing passwords. Enforce channel binding and minimize NTLM usage to reduce this risk.
Frequently asked questions
Can NTLM relay attacks be performed from outside the network?
Generally, no. The attacker needs to be on the same network segment to intercept and relay the authentication handshake.
Does disabling NTLM stop all relay attacks?
Disabling NTLM stops NTLM-specific relays, but attackers may use other protocols like SMB or LDAP for similar techniques.
How do I check if channel binding is enabled?
Check the system event logs for channel binding errors or successes. You can also use group policy settings to enforce it.
Are service accounts more vulnerable to relay attacks?
Yes, because they often have consistent permissions and are less likely to have interactive logins monitored closely.
How this guide was produced: written by the Sandbox Desk editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
