How to Defend Against an NTLM Relay Attack

Man-in-the-middle primer: attackers position between communicating parties to intercept and alter traffic. Covers AD-relevant forms—NTLM relay, LDAP relay—impacts like credential theft, and defenses.

How the PetitPotam attack works: EFSRPC authentication coercion relayed via NTLM to AD CS Web Enrollment (ESC8) can yield Domain Admin; the post maps the full chain and covers detection plus mitigations like disabling NTLM or enabling EPA.

Shares an infographic mapping common red team phishing attack workflows to blue team detective and preventative controls, plus practical stealth tips for both offensive operators and defenders.

Why 'SMB Signing not required' deserves attention: without signing, NTLM relay attacks grant access without cracking passwords. A GPO guide to enabling and requiring signing on servers and clients.

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

Password guessing attacks exploit default credentials, weak policies, and service accounts. The guide covers attack types, detection, and mitigation, including NIST-aligned guidance.