Glossary
NTLM relay
An attack that forwards a victim's NTLM authentication to another server in real time, authenticating as the victim without knowing the password.
In an NTLM relay attack, an attacker positioned between a client and a server (often after LLMNR poisoning or by coercing a machine to authenticate) forwards the NTLM challenge-response exchange to a different target. Because NTLM does not bind the authentication to a specific server or channel by default, the target accepts it and the attacker acts with the victim's rights. Relaying a domain controller's machine account to AD CS web enrollment or LDAP can lead to full domain compromise.
Mitigations include requiring SMB signing, LDAP signing and LDAP channel binding, enabling Extended Protection for Authentication on web services such as AD CS and Exchange, adding privileged accounts to Protected Users, and reducing NTLM usage overall.