DFSCoerce NTLM Relay Attack | Threat SnapShot

In this week's Threat SnapShot, we take a look at the DFSCoerce attack tool that was released a little over a week ago. Similar to PetitPotam that we covered previously, this falls into the category of NTLM relay attacks. As an attacker, if I can man-in-the-middle and intercept a DFS authentication request, I can relay that to Active Directory Certificate Services (AD CS) and use a Kerberos Ticket Granting Ticket (TGT) to gain full domain privileges. As always, we'll dive into the attack and discuss detection and prevention strategies.

DFSCoerce tool

Praetorian blog post with additional attack variation

Microsoft KB with recommended mitigations