> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-ntlm-relay-attack-against-a-microsoft-configuration-manager-site-server.md).
# Potential NTLM Relay Attack against a Microsoft Configuration Manager Site Server
### Synopsis
| Field | Value |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| Activation Period | 14 Days |
| Training Period | 30 Days |
| Test Period | 10 Minutes |
| Deduplication Period | 1 Day |
| Required Data | XDR Agent |
| Detection Modules | Identity Analytics |
| Detector Tags | Microsoft SCCM Analytics |
| ATT\&CK Tactic | Credential Access (TA0006), Lateral Movement (TA0008) |
| ATT\&CK Technique | Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay (T1557.001), Use Alternate Authentication Material: Pass the Hash (T1550.002) |
| Severity | Informational |
### Description
Multiple NTLM authentications were made to the same Microsoft Configuration Manager site server and user from different IPs in a short period of time. This might indicate a potential NTLM Relay attack.
### Attacker's Goals
An attacker may coerce the SCCM site server to authenticate to a malicious host and relay it to escalate privileges and move laterally across site systems.
### Investigative actions
* Ensure that the alerted host is not a NAT device or proxy that replicates or forwards network traffic as part of its expected operational behavior.
* Check if the protocols used are vulnerable to an NTLM relay attack (e.g. LDAP, SMB).
* Ensure that SMB signing is enabled in the case of a possible SMB relay attack.
* Check for network activity to and from the suspicious IP address to verify if it is a compromised machine.
* Monitor closely the actions of the potentially compromised user account for any anomalous behavior, especially suspicious SCCM-related activity occurring near the time of the alert.
### Variations
Potential NTLM Relay Attack against a Microsoft Configuration Manager Site Server using a vulnerable package
**Synopsis**
| Field | Value |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| ATT\&CK Tactic | Credential Access (TA0006), Lateral Movement (TA0008) |
| ATT\&CK Technique | Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay (T1557.001), Use Alternate Authentication Material: Pass the Hash (T1550.002) |
| Severity | Low |
**Description**
Multiple NTLM authentications were made to the same Microsoft Configuration Manager site server and user from different IPs using a vulnerable NTLM package in a short period of time. This might indicate a potential NTLM Relay attack.
**Attacker's Goals**
An attacker may coerce the SCCM site server to authenticate to a malicious host and relay it to escalate privileges and move laterally across site systems.
**Investigative actions**
* Ensure that the alerted host is not a NAT device or proxy that replicates or forwards network traffic as part of its expected operational behavior.
* Check if the protocols used are vulnerable to an NTLM relay attack (e.g. LDAP, SMB).
* Ensure that SMB signing is enabled in the case of a possible SMB relay attack.
* Check for network activity to and from the suspicious IP address to verify if it is a compromised machine.
* Monitor closely the actions of the potentially compromised user account for any anomalous behavior, especially suspicious SCCM-related activity occurring near the time of the alert.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-ntlm-relay-attack-against-a-microsoft-configuration-manager-site-server.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.