T5AI for Cloud & Identity Attack Paths

NTLM relay and coercion

How an attacker on the wire turns Windows' own authentication against it: poisoning name resolution with Responder, relaying NTLM with ntlmrelayx, and forcing authentication with coercion attacks.

Advanced6 min readprofessional streamUpdated Sat Aug 01 2026 00:00:00 GMT+0000 (Coordinated Universal Time)

Part ofThe AD Attack Chain, AI-Accelerated

Learning objectives

Explain the design flaw in NTLM that makes relay possible.
Distinguish passive poisoning from active coercion as ways to obtain authentication.
Choose a high-value relay target (AD CS, LDAP, or SMB) and justify it.
Recommend the signing and channel-binding controls that close the attack.
Keep relay and coercion, which touch live authentication, behind human approval.

Academy subscription

Subscribe to unlock this module

This module is part of the StrikeOps Academy subscription. Unlock every paid module, with hands-on labs and knowledge checks.

Every paid module across all tracks
Hands-on labs and knowledge checks
New content as it ships

$59/ month · or $590 / year

SubscribeBrowse free modules

The Reference library and Foundation starters are free to read now.

NTLM relay and coercion

How an attacker on the wire turns Windows' own authentication against it: poisoning name resolution with Responder, relaying NTLM with ntlmrelayx, and forcing authentication with coercion attacks.

Advanced6 min readprofessional streamUpdated Sat Aug 01 2026 00:00:00 GMT+0000 (Coordinated Universal Time)

Subscribe to unlock this module

This module is part of the StrikeOps Academy subscription. Unlock every paid module, with hands-on labs and knowledge checks.

Every paid module across all tracks

Hands-on labs and knowledge checks

New content as it ships

$59/ month · or $590 / year

The Reference library and Foundation starters are free to read now.