ThursDef™
NTLM Relaying & Mitigations
Thursday, February 12, 2026
Speaker
No recording is available for this session; the notes below cover it.
Event Notes
Disable RC4 for Kerberos, and watch for attempts to force it: alert on event 4769 with encryption type 0x17, which is RC4.
Resources and links
- Logan's recent post: Using NTLM Reflection to Own Active Directory (CVE-2025-33073)depthsecurity.com
- Microsoft's notice on disabling NTLM by defaulttechcommunity.microsoft.com
- SMB attacksvectra.ai
- Microsoft announces a new EVP of Securityblogs.microsoft.com
- Improper access control in Windows SMB (CVE-2025-33073)nvd.nist.gov
- Logan's RelayKinggithub.com
- Introducing RelayKing: Relay to Royaltydepthsecurity.com
- Misconfiguration Managergithub.com
- Respondergithub.com
- Respotter (detects Responder)github.com
- Locksmith 2, for AD CS audits (Jake Hildreth also covered it on ThursDef)github.com
- CVE-2025-33073 exploitgithub.com