Understanding
NTLM Relaying
and AD CS Attack Paths

What Is NTLM Relaying?

NTLM relaying is an attack technique where an adversary captures NTLM authentication from a victim system and forwards it to another service that accepts NTLM authentication. The attacker does not need to know the user’s password. The attack abuses the authentication exchange itself.

The risk depends on where NTLM is accepted, whether signing is required, whether channel binding is enforced, whether the target service validates authentication context correctly, and whether the relayed identity has meaningful access.

NTLM relay has historically affected SMB, LDAP, HTTP, Exchange-related services, printer-related paths, web enrollment services, and other Windows-integrated enterprise systems.

Why NTLM Relay Still Matters

NTLM relay remains relevant because many enterprise environments still support legacy authentication paths, mixed Windows infrastructure, internal web services, certificate enrollment endpoints, older applications, and services where signing or channel protections are inconsistent.

Attackers look for authentication flows that can be coerced, captured, and reused against higher-value services. When those services allow sensitive actions, a relay path may become a privilege escalation or domain compromise route.

Enterprise Condition	Relay Risk
NTLM Still Enabled	Legacy authentication remains available for attackers to abuse.
Signing Not Required	Services may accept relayed authentication without sufficient protection.
AD CS Web Enrollment Exposed	Certificate request paths may become relay targets.
Privileged Machine Accounts	Relayed machine authentication can create high-impact certificate or service access paths.
Weak Monitoring	Coercion, relay activity, unusual certificate issuance, and lateral movement may go unnoticed.

The real danger is not NTLM in isolation. The danger is how NTLM, AD CS, LDAP, SMB, HTTP, machine accounts, Kerberos, and weak monitoring can combine into a larger attack chain.

Active Directory Certificate Services and Relay Risk

Active Directory Certificate Services allows organizations to issue and manage certificates for users, systems, services, and authentication workflows. AD CS is powerful infrastructure because certificates can be used to authenticate to Active Directory and related services.

When AD CS is misconfigured or exposed through vulnerable enrollment paths, attackers may be able to abuse certificate templates, enrollment services, authentication relays, or identity mapping to gain long-lived access.

AD CS Area	Security Concern
Web Enrollment	HTTP-based enrollment endpoints may accept relayed authentication if protections are missing.
Certificate Templates	Overly permissive templates may allow inappropriate enrollment or authentication use.
Machine Certificates	Certificates tied to machine accounts may support authentication paths with major domain impact.
Enrollment Permissions	Users or computers may be allowed to request certificates they should not receive.
Monitoring Gaps	Suspicious certificate issuance may be missed without strong event collection and alerting.

AD CS security requires careful review of templates, enrollment permissions, NTLM exposure, web enrollment services, certificate mapping, event logging, and domain authentication paths.

Attack Path

The following figures illustrate a controlled offensive-security lab scenario showing how an NTLM relay path against AD CS can progress from initial domain credential access into certificate abuse and domain-impacting compromise. This sequence is included for security awareness, defensive validation, and remediation planning.

As shown below in Figure 1, the attack begins with access to a domain credential and identification of a certificate authority using web enrollment services. The relay tooling is positioned against the certificate authority using an AD CS-focused relay path.

With the relay path waiting for authentication, a coercion technique is then used in the lab environment to cause a machine authentication event. In this case, the attack flow succeeds and authentication is relayed to the certificate service. Figure 2 shows the successful relay activity.

Returning to the relay output, Figure 3 shows certificate material associated with the targeted machine account. This is the point where AD CS exposure becomes especially dangerous because the relayed authentication has resulted in certificate issuance.

The certificate material is then prepared for authentication use in the controlled lab scenario. As shown in Figure 4, the certificate-backed authentication path can support Kerberos ticket activity, allowing the attacker to request additional access without repeatedly providing the original credentials.

With certificate-backed authentication available, the attack path continues by identifying privileged users, services, and domain resources. Figure 5 shows the use of the obtained authentication material to request service access in the lab environment.

Because the certificate is associated with a high-value host in this scenario, the impact can become domain-wide. Figure 6 illustrates the final stage of the lab demonstration where domain compromise risk becomes clear, including access paths that could expose sensitive Active Directory database material.

Business Impact of NTLM Relay and AD CS Abuse

NTLM relay against AD CS is high impact because it can create an authentication path that bypasses normal password controls. If an attacker obtains certificate-backed authentication for a privileged identity or domain controller machine account, the compromise can escalate quickly.

Impact Area	Potential Outcome
Domain Compromise	Attackers may gain paths toward full Active Directory control.
Credential Exposure	Domain credential material may be exposed through later attack stages.
Persistence	Certificate-backed access can remain useful beyond a single password change if not remediated correctly.
Lateral Movement	Attackers can use domain trust and authentication paths to move across systems.
Detection Evasion	Activity may resemble legitimate authentication, certificate issuance, or administrative behavior.
Operational Disruption	Compromise of identity infrastructure can impact business operations, incident response, and recovery.

These risks are why AD CS should be treated as Tier 0 identity infrastructure and tested with the same seriousness as domain controllers, privileged identity systems, and core authentication services.

Detection Opportunities

Detecting NTLM relay and AD CS abuse requires visibility across authentication events, certificate enrollment events, domain controller activity, network traffic, endpoint telemetry, and identity behavior.

Defenders should pay special attention to unusual certificate requests, unexpected machine certificate issuance, NTLM authentication to sensitive services, coercion-like patterns, and privileged authentication behavior following certificate activity.

Detection Area	What to Monitor
Certificate Enrollment	Unusual certificate requests, unexpected templates, machine certificate issuance, and enrollment from abnormal sources.
NTLM Authentication	NTLM usage against sensitive services, certificate authority endpoints, LDAP, SMB, and HTTP services.
Coercion Indicators	Unexpected authentication from domain controllers or servers to unusual hosts.
Kerberos Activity	Suspicious certificate-backed authentication, unusual ticket activity, and privileged account access patterns.
Endpoint Telemetry	Unexpected relay tooling, administrative utilities, process chains, and network listeners.
Identity Context	Machine accounts or privileged identities behaving outside normal baselines.

Detection logic should be validated through safe adversary simulation because many relay paths look like legitimate Windows authentication until the full chain is understood.

Mitigation and Hardening Priorities

Reducing NTLM relay and AD CS abuse risk requires layered defenses across authentication protocols, certificate services, endpoint hardening, network segmentation, identity monitoring, and service configuration.

Control	Security Objective
Require Signing	Enforce SMB and LDAP signing where appropriate to reduce relay opportunities.
Harden AD CS	Review certificate templates, enrollment permissions, web enrollment exposure, and authentication settings.
Enable EPA	Use Extended Protection for Authentication where supported to reduce relay risk.
Restrict NTLM	Reduce NTLM usage where feasible and monitor remaining NTLM authentication paths.
Segment Critical Services	Limit access to certificate authorities, domain controllers, and sensitive administrative endpoints.
Monitor Certificate Issuance	Alert on suspicious enrollment events, template use, and machine certificate requests.
Validate With Testing	Confirm that hardening measures actually break relay paths and produce actionable alerts.

NTLM Relay as an Attack-Chain Component

NTLM relay rarely exists alone in real incidents. It often appears as one step in a larger chain involving credential access, coercion, certificate abuse, lateral movement, privilege escalation, and domain compromise.

A low or medium issue may become severe when it enables another step. For example, weak internal segmentation, NTLM exposure, permissive certificate templates, insufficient logging, and stale privileged access can combine into a high-impact path.

For related context, review Chaining Low-Risk Findings Into Breaches and Living off the Land Attacks Explained.

Testing Active Directory Security

Active Directory testing should validate practical attack paths, not just configuration snapshots. Relay exposure, AD CS posture, privileged access, credential paths, lateral movement, segmentation, and detection coverage must be reviewed together.

Testing Area	Validation Objective
NTLM Exposure	Identify where NTLM is accepted and whether relay protections are enforced.
AD CS Review	Assess certificate templates, enrollment permissions, web enrollment, and authentication mappings.
Privilege Paths	Determine whether users, computers, services, or groups create escalation opportunities.
Lateral Movement	Validate whether segmentation and endpoint controls prevent movement from likely footholds.
Detection Coverage	Confirm that relay, certificate, Kerberos, and privileged access activity create actionable alerts.
Retesting	Verify that remediation breaks the attack path and improves monitoring.

Redbot’s internal penetration testing and MITRE ATT&CK adversary simulation help organizations understand whether identity controls hold up under realistic attacker behavior.

How Redbot Validates NTLM Relay and AD CS Risk

Redbot Security validates NTLM relay and AD CS risk by safely testing whether authentication flows, certificate services, machine accounts, domain controllers, segmentation, and monitoring controls can be abused under realistic conditions.

The objective is to determine whether attackers can move from initial access to relayed authentication, certificate abuse, Kerberos access, lateral movement, privileged escalation, or domain compromise.

Assessment Area	Redbot Validation Focus
Relay Path Discovery	Identify relayable services, weak signing, NTLM exposure, and sensitive authentication targets.
AD CS Exposure	Review certificate templates, web enrollment, permissions, and certificate-backed authentication paths.
Attack-Path Validation	Safely demonstrate whether misconfigurations can combine into domain-impacting risk.
Detection Testing	Validate whether relay, coercion-like behavior, certificate issuance, and Kerberos activity generate alerts.
Remediation Guidance	Provide prioritized hardening steps for signing, AD CS, NTLM reduction, segmentation, and monitoring.
Retesting	Confirm that the attack path is broken after remediation.

Redbot delivers practical evidence, attack narratives, remediation guidance, and retesting support so security teams can understand and close identity-driven compromise paths before attackers exploit them.