NTLM (NT LAN Manager)
Windows’ legacy auth protocol.
Category: Active Directory · Kerberos & NTLM 🎯 Trench — Windows’ legacy auth protocol. Works as challenge-response: the server sends a challenge, you encrypt it with your password, you return it. If I intercept that conversation and forward it to another server, I authenticate without knowing your password. That’s a Relay. 🔗 Kill chain — Prerequisite: network without mandatory SMB Signing. Next: Pass-the-Hash, NTLM Relay to LDAP/SMB/HTTP, Coercion attacks (PetitPotam, PrinterBug). 📡 Defensive footprint — Event ID 4624 withLogon Type 3 and
an unexpected source machine name. Responder logs in the network
if you do LLMNR/NBT-NS poisoning.
⚠️ False friend — Assuming NTLMv2 is safe. It resists offline
brute force better but is just as vulnerable to relay without
signing.
🛡️ Remediation — Make SMB Signing and LDAP Signing
mandatory (not just recommended). Disable NTLMv1 via GPO.
Migrate as much as possible to Kerberos.
← Back to the full glossary Last updated: 2026-06-11