---
id: 5859
title: "How to Defend Against an NTLM Relay Attack"
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/how-to-defend-against-ntlm-relay-attack/"
published_at: "2024-01-26T16:18:00Z"
tags: ["active-directory", "credential-security", "defense", "detection", "ntlm-relay", "smb-signing", "petitpotam"]
phying_url: "https://phying.com/item/5859"
lang: en
---

# How to Defend Against an NTLM Relay Attack

## Summary

NTLM relay exploits the protocol's lack of mutual authentication: attackers capture and relay authentication sessions to other services, as in PetitPotam. Covers detection and SMB-signing defenses.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2024-01-26T16:18:00Z
- **Original:** https://www.semperis.com/blog/how-to-defend-against-ntlm-relay-attack/
- **Phying News:** https://phying.com/item/5859