DFSCoerce, a new NTLM relay attack, can take control over a Windows domain
Malwarebytes
JUNE 21, 2022
The NTLM protocol uses one or both of two hashed password values. Both passwords are also stored on the server (or domain controller). And through a lack of salting they are password equivalent, meaning that if you grab the hash value from the server, you can authenticate without knowing the actual password. Mitigation.
Let's personalize your content