Malware

ntlmrelayx

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1574.001DLLEvidence1

"utilized ntlmrelay to copy my malicious wbemcomn.dll file with a reverse shell into the c:\windows\system32\wbem directory. This file was subsequently loaded... granting me a shell with SYSTEM, Network Service, or logged-in User privileges"

Persistence

2 techniques

T1098Account ManipulationEvidence2

Using the relayed LDAP authentication, grant DCSync privileges to the attacker account.

T1136Create AccountEvidence2

The second attack requires control over a computer account... or a computer account the attacker created, abusing the fact that any account in Active Directory can create those by default.

Privilege Escalation

3 techniques

T1068Exploitation for Privilege EscalationEvidence1

This allows for Remote code execution as SYSTEM on any unpatched Windows server or workstation... and for instant escalation to Domain Admin via any unpatched Exchange server

T1098Account ManipulationEvidence2

Using the relayed LDAP authentication, grant DCSync privileges to the attacker account.

T1548Abuse Elevation Control MechanismEvidence1

This technique may allow an attacker to relay a site server's domain computer account to a remote SMS Provider and elevate their privileges to "Full Administrator" for the SCCM hierarchy.

Stealth

1 technique

T1574.001DLLEvidence1

Credential Access

5 techniques

T1003.002Security Account ManagerEvidence1

"...relayed the authentication to the SMB service... and dumped the local SAM database"

T1187Forced AuthenticationEvidence2

通信の不正中継 Fake WPAD Htran NTLMRelayX

T1557Adversary-in-the-MiddleEvidence9

通信の不正中継 Fake WPAD Htran NTLMRelayX

T1557.001LLMNR/NBT-NS Poisoning and SMB RelayEvidence11

this can be used in NTLM Relay attacks to the Exchange itself.

T1558Steal or Forge Kerberos TicketsEvidence1

by abusing Resource Based Constrained Kerberos delegation, it is possible to grant an attacker impersonation rights on the victim server

Lateral Movement

3 techniques

T1021Remote ServicesEvidence2

The SMS Provider also provides access to the site database via the administration service (AdminService) REST API and uses Microsoft Negotiate for authentication... targeting the URL of the AdminService API on the remote SMS Provider... -t https://SMS_PROVIDER_URL_OR_IP/AdminService/wmi/SMS_Admin

T1021.001Remote Desktop ProtocolEvidence1

ntlmrelayx HTTP, WebDAV, RDP, and SCCM 6 WPAD, WebDAV, RDP relay certificate, SCCM policy strings

T1021.002SMB/Windows Admin SharesEvidence2

Using any AD account, connect over SMB to the victim server, and trigger the SpoolService bug.

Collection

2 techniques

T1557Adversary-in-the-MiddleEvidence9

通信の不正中継 Fake WPAD Htran NTLMRelayX

T1557.001LLMNR/NBT-NS Poisoning and SMB RelayEvidence11

this can be used in NTLM Relay attacks to the Exchange itself.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

ntlmrelayx HTTP, WebDAV, RDP, and SCCM 6 WPAD, WebDAV, RDP relay certificate, SCCM policy strings

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Jan 6, 2026

Active Directory Attack Kill Chain Checklist & Tools List- 2026

ntlmrelayx is a tool for relaying NTLM authentication to other services, enabling privilege escalation and lateral movement in Windows environments.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

ntlmrelayx

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1574.001DLLEvidence1

Persistence

2 techniques

T1098Account ManipulationEvidence2

Using the relayed LDAP authentication, grant DCSync privileges to the attacker account.

T1136Create AccountEvidence2

The second attack requires control over a computer account... or a computer account the attacker created, abusing the fact that any account in Active Directory can create those by default.

Privilege Escalation

3 techniques

T1068Exploitation for Privilege EscalationEvidence1

This allows for Remote code execution as SYSTEM on any unpatched Windows server or workstation... and for instant escalation to Domain Admin via any unpatched Exchange server

T1098Account ManipulationEvidence2

Using the relayed LDAP authentication, grant DCSync privileges to the attacker account.

T1548Abuse Elevation Control MechanismEvidence1

This technique may allow an attacker to relay a site server's domain computer account to a remote SMS Provider and elevate their privileges to "Full Administrator" for the SCCM hierarchy.

Stealth

1 technique

T1574.001DLLEvidence1

Credential Access

5 techniques

T1003.002Security Account ManagerEvidence1

"...relayed the authentication to the SMB service... and dumped the local SAM database"

T1187Forced AuthenticationEvidence2

通信の不正中継 Fake WPAD Htran NTLMRelayX

T1557Adversary-in-the-MiddleEvidence9

通信の不正中継 Fake WPAD Htran NTLMRelayX

T1557.001LLMNR/NBT-NS Poisoning and SMB RelayEvidence11

this can be used in NTLM Relay attacks to the Exchange itself.

T1558Steal or Forge Kerberos TicketsEvidence1

by abusing Resource Based Constrained Kerberos delegation, it is possible to grant an attacker impersonation rights on the victim server

Lateral Movement

3 techniques

T1021Remote ServicesEvidence2

T1021.001Remote Desktop ProtocolEvidence1

ntlmrelayx HTTP, WebDAV, RDP, and SCCM 6 WPAD, WebDAV, RDP relay certificate, SCCM policy strings

T1021.002SMB/Windows Admin SharesEvidence2

Using any AD account, connect over SMB to the victim server, and trigger the SpoolService bug.

Collection

2 techniques

T1557Adversary-in-the-MiddleEvidence9

通信の不正中継 Fake WPAD Htran NTLMRelayX

T1557.001LLMNR/NBT-NS Poisoning and SMB RelayEvidence11

this can be used in NTLM Relay attacks to the Exchange itself.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

ntlmrelayx HTTP, WebDAV, RDP, and SCCM 6 WPAD, WebDAV, RDP relay certificate, SCCM policy strings

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Jan 6, 2026

Active Directory Attack Kill Chain Checklist & Tools List- 2026

ntlmrelayx is a tool for relaying NTLM authentication to other services, enabling privilege escalation and lateral movement in Windows environments.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.