Attackers use SMB relay to intercept an SMB authentication exchange and forward it to another SMB service that accepts the relayed credentials. If successful, they gain access as the victim without knowing the password. Defenders should require SMB signing where possible, limit NTLM use, and monitor for unexpected authentication chains or local network coercion attempts.
How SMB relay works at the protocol level
smb relay is not password cracking. It abuses the fact that a challenge-response authentication exchange can be forwarded to a different SMB service that will accept the victim’s response as valid. The attacker sits in the middle, preserves the authentication flow, and uses the victim’s trust in the network path to become authenticated as that victim.
That makes the technique especially useful when the attacker can induce a machine or user to authenticate over the local network, then reuse that authentication toward a more valuable target. The core idea is credential forwarding, not credential recovery, so the attack can succeed even when the password itself is never learned.
In practice, relay succeeds when the target service accepts the relayed authentication method and the environment allows the attacker to capture or coerce traffic before it is protected by stronger transport or signing requirements. The technique is closely tied to lateral movement patterns, and Lateral Movement Guide covers the SMB admin-share and ntlm relay tradecraft that defenders usually see around it.
Why attackers use SMB relay in real intrusions
Attackers use SMB relay because it turns one successful authentication event into access on another system with very little noise compared with password theft. It is attractive in environments where NTLM is still allowed, SMB signing is inconsistent, or local network coercion techniques can trigger inbound authentication from a more privileged host.
The technique is also useful as a bridge from initial foothold to deeper access. If the relayed identity has administrative rights, file-share access, or local system privileges on the destination service, the attacker may immediately gain a foothold for execution, enumeration, or follow-on credential theft.
For defenders, the important detail is that relay is often part of a broader chain rather than a standalone objective. The relayed session can be used to plant tools, access shares, manipulate configuration, or enable another step that depends on the same authenticated context. Identity Threat Detection and Response (ITDR) Guide is relevant here because the detection problem is often identity abuse plus lateral movement, not just a network anomaly.
What breaks SMB relay and what defenders should watch for
The strongest practical defenses reduce the attacker’s ability to forward authentication or make the forwarded session unacceptable to the target service. SMB signing helps because it binds the session in a way that makes simple relay ineffective, while limiting NTLM reduces the number of authentication flows that can be abused in the first place.
Detection should focus on unusual authentication chains, unexpected inbound SMB sessions, and local-network coercion behavior that causes hosts to authenticate where they normally would not. A relay attempt often becomes visible only when the authentication path does not match normal user or service behavior.
Defenders should also treat the destination service and the relayed account as part of the risk analysis. If an administrative or service identity can be reused across systems, the blast radius of a successful relay is much larger than a one-off unauthorized share access event. The same pattern is often discussed alongside The State of NHI & AI Agent Breach Report 2026, which is useful for understanding how stolen or relayed credentials become operational access in real attack chains.
Risk and Threat Considerations
SMB relay is dangerous because it turns trust in local network authentication into a privilege escalation path. If an attacker can coerce an authentication exchange and the environment still allows relayed NTLM sessions, a single inbound response can become unauthorized access to file shares, hosts, or administrative functions.
Failure mechanism: The attacker intercepts or induces an SMB authentication exchange, forwards the response to another service that accepts it, and inherits the victim’s access without knowing the secret behind the exchange.
Impact: The attacker may gain authenticated access, move laterally, access sensitive shares, and use the relayed session to stage additional compromise steps. Where privileged identities are involved, the result can be rapid expansion from local network abuse to domain-wide exposure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1557 — Adversary-in-the-Middle | SMB relay is an adversary-in-the-middle credential relay technique. |
| T1021 — Remote Services | SMB relay is used to abuse remote service access after authentication is relayed. | |
| Recommendation — Hunt for relay and coercion patterns that enable forwarded authentication. Correlate remote service logons with unusual source and destination pairs. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Limiting NTLM use and controlling credential lifecycles directly reduces relay exposure. |
| IA-2 — Identification and Authentication (Organizational Users) | SMB relay abuses user authentication acceptance on the destination service. | |
| AC-6 — Least Privilege | Relay impact depends on the permissions of the relayed identity. | |
| Recommendation — Restrict and manage authenticators that can be relayed. Enforce stronger authentication requirements for user access paths. Reduce the permissions any relayed account can exercise. | ||
Practitioner Guidance
What to verify: Confirm where SMB signing is enforced, where NTLM is still accepted, and which systems can be induced to authenticate over the local network. The practical question is not whether SMB exists, but whether the environment still gives an attacker a usable relay path.
Decision rule: If the relayed account can reach anything beyond a low-value share, treat the condition as a privilege and lateral-movement problem, not just an authentication nuisance. Prioritise removing relayability and constraining the destination permissions before spending time on attribution.
Practitioner takeaway: SMB relay succeeds when authentication is trusted more than the path and the target accepts that trust, so the most effective defense is to remove relayable authentication paths and shrink the value of any session that can still be relayed.