How to Detect NTLM Relay Attacks and Enforce SMB Signing

Attack flow with Responder + ntlmrelayx:

1. Attacker starts ntlmrelayx targeting all domain computers:
   ntlmrelayx.py -tf targets.txt -smb2support
   (targets.txt = list of all domain IPs from nmap/netdiscover)

2. Attacker starts Responder to capture NTLM challenges:
   Responder.py -I eth0 -rdwv

3. Victim's workstation sends NTLM challenge to Responder:
   - Victim browses \\fileserver (typo, or LLMNR poisoned)
   - Windows sends NTLMv2 challenge to Responder's fake server
   - Responder captures the challenge and sends to ntlmrelayx

4. ntlmrelayx relays the challenge to target servers:
   - Tries to authenticate to each IP in targets.txt
   - On success: drops a shell, dumps SAM, or creates accounts

Terminal output of successful relay:
[*] SMBD-Thread-4: Connection from 10.1.1.50 controlled, attacking target smb://10.1.1.100
[*] Authenticating against smb://10.1.1.100 as CORP\JSMITH SUCCEED
[*] Target is not signing, dumping SAM hashes...
Administrator:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

LDAP relay (domain admin creation):

# If target is a DC and LDAP signing is not enforced:
ntlmrelayx.py -t ldaps://dc01.corp.local --add-computer AttackerPC$
# Or create a user with domain admin rights:
ntlmrelayx.py -t ldap://dc01.corp.local --escalate-user lowpriv_user

SMB signing prevents NTLM relay over SMB by requiring each packet to be signed. When signing is required, captured NTLM challenges from one connection cannot be used to authenticate on a different connection.

GPO settings to enforce SMB signing on all domain members:

Computer Configuration > Windows Settings > Security Settings >
Local Policies > Security Options

For SMB server (incoming connections):
"Microsoft network server: Digitally sign communications (always)"
Value: Enabled

For SMB client (outgoing connections):
"Microsoft network client: Digitally sign communications (always)"
Value: Enabled

Registry equivalents (for verification):
HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
  RequireSecuritySignature = 1  (server: incoming)

HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
  RequireSecuritySignature = 1  (client: outgoing)

# Verify SMB signing is required on a host:
Get-SmbServerConfiguration | Select-Object RequireSecuritySignature, EnableSecuritySignature
# RequireSecuritySignature : True  ← relay impossible (required)
# RequireSecuritySignature : False ← relay possible (optional or disabled)

Get-SmbClientConfiguration | Select-Object RequireSecuritySignature

# Check domain-wide via PowerShell (run from domain-joined machine):
Get-ADComputer -Filter * -Properties OperatingSystem | Where-Object {
    $_.OperatingSystem -like '*Windows*'
} | ForEach-Object {
    $computer = $_.DNSHostName
    try {
        $config = Invoke-Command -ComputerName $computer -ScriptBlock {
            Get-SmbServerConfiguration | Select-Object RequireSecuritySignature
        } -ErrorAction Stop
        [PSCustomObject]@{
            Computer = $computer
            RequireSigning = $config.RequireSecuritySignature
        }
    } catch {
        [PSCustomObject]@{ Computer = $computer; RequireSigning = 'ERROR' }
    }
} | Sort-Object RequireSigning
# Identify all machines still showing RequireSigning = False

Also enforce LDAP signing and channel binding (prevents LDAP relay):

Computer Configuration > Windows Settings > Security Settings >
Local Policies > Security Options

"Domain controller: LDAP server signing requirements"
Value: Require signing

"Domain controller: LDAP server channel binding token requirements"
Value: Always (requires Windows Server 2019 + April 2020 or later patches)

Event 4624 Type 3 with NTLM from unexpected sources:

// Detect NTLM logons from machines that should not be authenticating to each other
// Focus: workstation-to-workstation NTLM (not DCs, not servers)
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4624
| where LogonType == 3  // Network logon
| where AuthenticationPackageName == "NTLM"
// Exclude expected service accounts and machine accounts:
| where TargetUserName !endswith "$"  // Exclude machine account logons
| where TargetDomainName != "NT AUTHORITY"
| extend SourceIP = tostring(IpAddress)
| extend TargetComputer = Computer
// Alert when the source IP is a workstation range (not a server or DC):
// Adjust IP ranges to match your environment
| where SourceIP startswith "10.1.1."  // Workstation subnet
| where TargetComputer !in ("dc01", "dc02", "fileserver01")  // Not to expected servers
| summarize
    Count = count(),
    TargetAccounts = make_set(TargetUserName),
    SourceIPs = make_set(SourceIP)
    by TargetComputer, bin(TimeGenerated, 1h)
| where Count > 5  // Multiple NTLM logons = relay tool scanning

Detect ntlmrelayx SAM dump indicator (mass logon attempts):

// ntlmrelayx dumps SAM by authenticating then calling registry service
// Indicator: rapid successful NTLM logons from a single source IP
SecurityEvent
| where TimeGenerated > ago(1h)
| where EventID == 4624 and LogonType == 3
| where AuthenticationPackageName == "NTLM"
| summarize LogonCount = count() by IpAddress, bin(TimeGenerated, 5m)
| where LogonCount > 10  // More than 10 NTLM logons in 5 minutes from one IP
| project TimeGenerated, IpAddress, LogonCount
// High confidence: ntlmrelayx scanning with -tf targets.txt generates rapid logons

Detect Responder via Event 4776 anomalies:

// Event 4776 = NTLM authentication attempt (on DC)
// Responder captures appear as auth attempts TO the DC from rogue machine
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4776  // Credential validation via NTLM
| where Status != "0x0"  // Failed authentications
// Bulk failed NTLM auths from one source = Responder capturing challenges:
| summarize FailureCount = count() by WorkstationName, bin(TimeGenerated, 10m)
| where FailureCount > 20

Disable NTLM entirely for Kerberos-capable services (gold standard):

GPO: Computer Configuration > Windows Settings > Security Settings >
Local Policies > Security Options

"Network security: Restrict NTLM: NTLM authentication in this domain"
Value: Deny all  (requires thorough testing: will break legacy apps that require NTLM)

Alternative: Start with Audit mode to identify NTLM users:
"Network security: Restrict NTLM: Audit NTLM authentication in this domain"
Value: Enable all
Then review Event 8004 in the Microsoft-Windows-NTLM/Operational event log

Enable Extended Protection for Authentication (EPA) on IIS:

# EPA prevents NTLM relay to HTTP/HTTPS endpoints
# Requires Windows Server 2019+ and modern clients
Import-Module WebAdministration
Set-WebConfigurationProperty -Filter 'system.webServer/security/authentication/windowsAuthentication' \
    -Name 'extendedProtection.tokenChecking' -Value 'Require'

Honey credentials for relay detection:

# Create a honey account with a weak password that triggers alerts on any use:
New-ADUser -Name 'svc-backup01' -SamAccountName 'svc-backup01' \
    -AccountPassword (ConvertTo-SecureString 'HoneyPassword123!' -AsPlainText -Force) \
    -Enabled $true
# Alert: any successful logon for this account = credential theft or relay
# In Sentinel: alert on SecurityEvent where TargetUserName == 'svc-backup01' and EventID == 4624