Machine Account NTLM Relay

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	10 Minutes
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Palo Alto Networks Firewall traffic Logs OR XDR Agent
ATT&CK Tactic	Credential Access (TA0006), Lateral Movement (TA0008)
ATT&CK Technique	Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay (T1557.001), Use Alternate Authentication Material: Pass the Hash (T1550.002)
Severity	Low

Description

An NTLM NTProofStr was seen from more than one source. This indicates that machine account NTLM authentication data has been relayed.

Attacker's Goals

The attacker is attempting a man-in-the-middle NTLM relay attack to intercept authentication attempts and move laterally within an environment.

Investigative actions

• Check that the alerted host is not a NAT or a proxy that duplicates traffic as part of its normal behavior.
• Check if the protocols used are vulnerable to an NTLM relay attack (e.g. LDAP, SMB).
• Ensure that SMB signing is enabled in the case of a possible SMB relay attack.