SMB Relay is an attack where captured Windows authentication traffic is forwarded to another service so the attacker can authenticate as the victim without cracking the password. It depends on weak protections around SMB and NTLM. Defenders reduce exposure with signing, NTLM restrictions, segmentation, and monitoring for authentication relays.
How SMB Relay Works
SMB Relay is not password cracking, it is authentication replay. An attacker captures Windows authentication traffic and forwards it to another service that accepts the relayed exchange, letting the attacker act as the victim without knowing the password.
The technique matters because the security boundary is broken at the moment the protocol response is accepted. If the downstream service does not require stronger protections, a valid authentication exchange can be repurposed as an unauthorized session.
Why SMB Relay Is Effective
SMB Relay succeeds when SMB and NTLM are exposed to conditions that make relay possible, such as weak signing enforcement, permissive network paths, or services that still trust relayed NTLM authentication. In practice, the attacker is exploiting trust in the transport and the authentication flow, not the password itself.
This is why SMB Relay often appears alongside coercion and name-resolution abuse. The attacker only needs a way to induce or intercept authentication and a target that will accept it. NIST’s Zero Trust Architecture is useful here because it treats network location and implicit trust as insufficient proof.
Exposure Checks and Defensive Controls
Organisations check exposure by inventorying where SMB is reachable, where NTLM is still permitted, and which servers or applications accept relay-prone authentication paths. That review should include internet exposure, internal segmentation gaps, and vendor or platform settings that weaken signing or authentication hardening.
The most relevant controls are the ones that remove the relay opportunity rather than only watching for it. Enforcing signing, restricting NTLM, tightening segmentation, and reducing unnecessary remote service exposure all raise the cost of the attack. The NIST SP 800-53 Rev 5 Security and Privacy Controls maps well to access control, authentication, auditing, and configuration hardening.
Detection and Post-Compromise Review
Detection focuses on unusual authentication paths, unexpected service logons, and signs that a legitimate Windows authentication exchange was reused against a different target. Monitoring should also look for downstream activity that follows a successful relay, such as remote service use, lateral movement, or abnormal administrative access patterns.
After a suspected relay, review the affected hosts and accounts as if the authentication boundary may already have been crossed. The MITRE ATT&CK Enterprise Matrix is helpful for mapping relay activity to credential access and lateral movement behaviours, while NHIMG’s Lateral Movement Guide covers SMB admin shares, ntlm relay, segmentation, and detection patterns in one place.
Risk and Threat Considerations
SMB Relay is dangerous because it turns a captured authentication exchange into immediate access, often without triggering password-related defenses. The material risk is unauthorized access, lateral movement, and trust abuse in environments that still accept relayed Windows authentication.
Failure mechanism: A service accepts relayed NTLM authentication without protections such as signing or equivalent relay resistance, so the attacker can reuse a victim’s authentication exchange against another target.
Impact: Attackers can impersonate users or services, reach remote resources, move laterally, and potentially extend compromise across systems that assume the original authentication was trustworthy.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | SMB Relay abuses trusted account use across services. |
| IA-2 — Identification and Authentication (Organizational Users) | Relayed Windows auth succeeds when authentication is accepted without stronger verification. | |
| SC-7 — Boundary Protection | Relay risk increases when internal paths and service reachability are too open. | |
| Recommendation — Tighten account scope and revoke unnecessary service access paths. Require stronger authentication settings for user access paths. Segment reachable services to block unnecessary relay paths. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | SMB Relay is reduced by limiting which accounts and services can be used where. |
| Recommendation — Restrict service access and remove unnecessary authentication paths. | ||
Practitioner Guidance
What to watch for: Treat SMB Relay as a protocol trust problem, not just a malware problem. If one service can be coerced into authenticating to another, the control question is whether the destination will reject or neutralize the relayed session.
Governance implication: Ownership should sit with identity, endpoint, and network teams together, because the weak point is usually the interaction between authentication policy, service configuration, and internal routing. The fastest reductions in exposure usually come from removing relay-prone paths and enforcing the same hardening standard across servers, not from isolated host-by-host fixes.