---
id: 5980
title: "Detecting and Mitigating the PetitPotam Attack on Windows Domains"
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/petitpotam-attack-on-windows-domains/"
published_at: "2021-08-02T18:29:31Z"
tags: ["active-directory", "mitigation", "adcs", "esc8", "ntlm-relay", "petitpotam"]
phying_url: "https://phying.com/item/5980"
lang: en
---

# Detecting and Mitigating the PetitPotam Attack on Windows Domains

## Summary

How the PetitPotam attack works: EFSRPC authentication coercion relayed via NTLM to AD CS Web Enrollment (ESC8) can yield Domain Admin; the post maps the full chain and covers detection plus mitigations like disabling NTLM or enabling EPA.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2021-08-02T18:29:31Z
- **Original:** https://www.semperis.com/blog/petitpotam-attack-on-windows-domains/
- **Phying News:** https://phying.com/item/5980