Attackers use PetitPotam to coerce a Windows system into authenticating to an attacker-controlled listener, which can then be relayed to another service if relay protections are weak. It is commonly used as a step in NTLM relay abuse. Defenders should limit coercion paths, require signing and other relay mitigations, and monitor for unusual outbound authentication.
How PetitPotam turns a Windows host into a relay source
PetitPotam is an authentication coercion technique, not a payload by itself. The attacker triggers a Windows system to initiate an outbound authentication attempt to a listener they control, then captures that traffic and attempts to relay it to a different service. The technique matters because the abuse only becomes useful when the target service accepts relayed authentication and key mitigations are absent or weak.
A key practical detail is that the coerced connection is usually valuable as a stepping stone, not the end goal. Attackers use it to obtain a machine or user authentication event that can be forwarded into LDAP, HTTP, SMB, or another reachable service, depending on the environment and relay conditions. That makes the real question less about the coercion primitive itself and more about whether the surrounding Windows environment still permits NTLM relay abuse.
Where the relay path succeeds or fails
PetitPotam is most effective where defenders have left room for protocol downgrade, unsigned channels, or services that still accept relayed authentication without strong binding to the original session. In practice, the attack chain depends on a combination of coercion surface, outbound reachability, and the target service’s tolerance for relayed credentials. If any one of those pieces is closed off, the technique becomes far less useful.
Defensive controls therefore need to cover both ends of the chain. Blocking the coercion vector alone may not be enough if other relay paths remain available, and hardening only the destination service may still leave a broad set of coercion opportunities. The Lateral Movement Guide is useful here because it maps PetitPotam into the wider NTLM relay and lateral movement pattern rather than treating it as an isolated trick. At the protocol layer, CISA cyber threat advisories provide the broader context for coercion and relay abuse that defenders should track alongside local hardening.
What defenders should watch for in live environments
Monitoring should focus on unusual outbound authentication from systems that normally do not initiate that pattern, especially when the destination is unexpected or appears to be a listener rather than a legitimate service. The most useful signal is not a single authentication event in isolation, but a sequence that starts with coercion, continues with outbound NTLM activity, and then aligns with suspicious access against a second service.
Response teams should also treat relay success as a potential sign of broader exposure, not just a one-off abuse of a single host. If an attacker can coerce one Windows system, they may be able to repeat the pattern across other machines or combine it with additional identity abuse to reach privileged services. Identity Threat Detection and Response (ITDR) Guide is relevant because the detection challenge is fundamentally about recognising identity misuse and anomalous authentication behavior, while The State of NHI & AI Agent Breach Report 2026 reinforces how stolen or coerced authentication material often becomes the entry point for wider compromise.
Risk and Threat Considerations
PetitPotam is dangerous because it converts a normal trust relationship into an attacker-controlled authentication source. The risk is highest where outbound authentication is broadly permitted and relay protections are inconsistent across services, since a single coerced connection can become a bridge into systems that were never meant to accept that authentication context.
Failure mechanism: The attacker coerces a Windows host to authenticate outward, captures the authentication exchange, and relays it to another service that accepts the session without strong relay resistance or signing enforcement.
Impact: Successful relay can expose sensitive services to unauthorized access, enable privilege escalation or account abuse, and provide a foothold for further lateral movement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1212 — Exploitation for Credential Access | PetitPotam is used to coerce auth and support credential relay abuse. |
| Recommendation — Map coercion-driven relay activity to T1212 and hunt for follow-on credential abuse. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Relay abuse depends on exposed paths and weak network/service protections. |
| Recommendation — Restrict exposed paths and harden services that accept inbound authentication. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | The attack abuses Windows authentication exchanges to gain unauthorized access. |
| IA-5 — Authenticator Management | Coerced auth becomes useful when credentials and authenticators can be relayed. | |
| SC-8 — Transmission Confidentiality and Integrity | Relay attacks exploit weak protection of authentication in transit. | |
| Recommendation — Enforce strong user authentication and reject unsafe relay-based access paths. Rotate and protect authenticators, and reduce opportunities for relay abuse. Protect authentication traffic in transit and require integrity on sensitive channels. | ||
Practitioner Guidance
What to prioritise: Validate which internal services still accept relayed authentication and which Windows roles or endpoints can be coerced into outbound auth. The highest-value fixes are the ones that remove both the coercion source and the relay destination, because partial hardening leaves the chain intact.
What to verify: Confirm that relay mitigations are enforced where they matter, especially signing or equivalent protections on the services attackers most want to reach. Also verify that detection logic distinguishes routine authentication from coercion-driven bursts or unusual listener destinations.
Practitioner takeaway: Treat PetitPotam as a chain-building technique, not a standalone exploit, and close the relay path at both ends if you want the risk to fall materially.