NTLM
noun · also NT LAN Manager · Microsoft Learn: NTLM overview
An older Windows challenge-response authentication protocol, still used as a fallback to Kerberos and a frequent target of relay and pass-the-hash attacks.
NTLM is the authentication protocol Windows used before Kerberos, and it is still around for compatibility: when Kerberos cannot be used, for example when a server is reached by IP address instead of by name, or when a device is not joined to the domain, Windows falls back to NTLM.
In NTLM, the server sends a random challenge, and the client answers with a response computed from the user's password hash. That design has two well-known weaknesses. Anyone holding the hash can compute valid responses without knowing the password (pass-the-hash), and an attacker in the middle can forward a victim's authentication to another server (NTLM relay). The older NTLMv1 variant is also weak enough to crack quickly. Microsoft has deprecated NTLM and recommends Kerberos through the Negotiate package instead.
Example
An attacker on the internal network tricks a server into authenticating to a machine they control, then relays that NTLM authentication to a certificate server or a file share where the server's account has rights, gaining access as that server without ever cracking a password.
Why it matters for a SOC analyst
NTLM shows up in logs as event 4776 on domain controllers and as 4624 logons with the NTLM authentication package. Knowing where NTLM is still used in your environment helps you spot when it is used where it should not be, for example an administrator account authenticating with NTLM to many servers in a short time, which is a classic sign of pass-the-hash.
Related terms
- Kerberos
The ticket-based authentication protocol used by Active Directory, in which a domain controller issues tickets that prove a user's identity to services.
- Pass-the-hash
Authenticating as a user with their stolen password hash instead of the password itself, abusing how NTLM works to move between Windows systems.
- Domain controller
A Windows server running Active Directory Domain Services: it stores accounts and password hashes and authenticates every sign-in in the domain.
- Lateral movement
The techniques attackers use to move from the first compromised system to other systems and accounts inside a network.