---
id: 9396
title: "There and Back Again: An Operators Guide on NTLM Relaying Egress"
source_domain: specterops.io
source_url: "https://specterops.io/blog/2026/07/15/there-and-back-again-an-operators-guide-on-ntlm-relaying-egress/"
published_at: "2026-07-15T16:00:00Z"
phying_url: "https://phying.com/item/9396"
lang: en
---

# There and Back Again: An Operators Guide on NTLM Relaying Egress

## Summary

See how the "There and Back Again" NTLM relay attack coerces outbound auth to compromise Active Directory, plus the defenses that stop it.

## Intelligence Metadata

- **Sources:** specterops.io
- **Published:** 2026-07-15T16:00:00Z
- **Original:** https://specterops.io/blog/2026/07/15/there-and-back-again-an-operators-guide-on-ntlm-relaying-egress/
- **Phying News:** https://phying.com/item/9396