Windows Domain - Attack & Defense: 02 NTLM Relay 

Hi! When you say external, do you mean out through the internet? The simplest answer is block outbound traffic that isn't needed. So, only allow DNS and HTTP(S) maybe. Another way to look at is to make sure there is nothing exposed that can receive the relayed authentication. NTLM itself is a vulnerable auth protocol, so you don't want to use it for anything you have accessible online.

@@Volkis hey Volkis! Thanks for the reply and enjoyed the video. I have disabled NTLM entirely on a clients DC , their only server, but am not sure if that will still allow requests to come through or not, I need to check the logs again. I was getting 30+ failed logins for a bunch of user names (some correct, some incorrect usernames), so I disabled it. Wondering if I need to enable SMB signing still, or honestly not even sure how the requests are being made 😟

@@foxxrider250r I'll need more context, so reach out through our website if you'd like. But, generally speaking if you disabled NTLM everywhere in the domain that will certainly stop NTLM Relay attacks. Technically, you don't need to enable signing then, but as a "just in case" you can still enable it. I'm not sure where the failed logins are coming from, but if you have NTLM disabled, Windows machines will use Kerberos (which should work unless they're using XP).

CME is always being updated so the format might be different now. Or it might be another problem. Hope you figure out the issue!

Theoretically, yes! NTLM is NTLM everywhere. In fact, a lot of exploits for the ADCS vulnerabilities were using SMB -> HTTP style relaying.

@@Volkis When i put NTLM AUTHENTICATE_MESSAGE in Authorization header and call IIS server it denies it.

There are lots of tools to check if Signing is enabled. We like to use CrackMapExec for this and a lot of other functionality.

If you're setting "(always)", it will take precedent over "(if x agrees)", so it won't matter, but you can enable them too just in case.