Reduce SMB relay risk by requiring SMB signing wherever possible, blocking NTLM where it is not needed, and removing local administrator reuse that makes relayed authentication valuable. Also disable unnecessary services that expose NTLM authentication, segment management networks, and monitor for authentication relays between hosts that should not be communicating.
When SMB relay attacks become practical
smb relay works because the attacker can intercept or coerce an authentication exchange and forward it to another host that accepts the relayed credentials. That risk becomes highest where SMB signing is absent, NTLM is still allowed, and systems expose admin-level trust across machines. The attack is not about cracking a password, it is about reusing a legitimate authentication flow against a different target.
In practice, organisations should treat SMB relay as a trust-boundary failure between endpoints, not just a Windows hardening issue. If one machine can be induced to authenticate to another over an unsigned or relayable path, the attacker can often turn that single exchange into remote code execution, file access, or administrative control.
One useful way to think about the problem is that SMB relay only pays off when the relayed identity still has value on the destination host. That is why local administrator reuse, overly broad workstation-to-workstation trust, and management paths that accept NTLM all increase the blast radius of a successful relay attempt.
How to reduce relay opportunity without breaking operations
The most effective control is to require SMB signing wherever your platform and application estate can support it, because signing prevents the attacker from transparently relaying the session to a different host. Where SMB signing cannot be enforced immediately, reduce the number of systems that will accept NTLM and remove unnecessary SMB exposure from segments that do not need it.
Credential design matters as much as protocol hardening. If the same local administrator password works across many systems, a relayed login can turn into broad lateral movement. Unique local administrator credentials, restricted administrative paths, and removal of unnecessary remote admin reachability sharply reduce the value of a relay even when an attacker captures one.
Because relay attacks often depend on noisy but ordinary-looking authentication traffic, the control surface should include network segmentation and service reduction. Disable services that expose NTLM authentication when they are not required, and separate management traffic from general user traffic so that a captured authentication exchange cannot be reused against high-value hosts.
What to watch for after hardening
Hardening reduces opportunity, but it does not prove the environment was never exposed. Relay attempts often leave behind signs of coercion, unexpected authentication between hosts, or successful remote service use from systems that normally should not talk to each other. That makes host-to-host authentication paths worth reviewing whenever SMB relay is part of the threat model.
The Lateral Movement Guide is useful here because SMB relay is rarely an isolated trick, it is usually one step in a broader movement chain involving admin shares, remote execution, or credential reuse. Teams should also review the Identity Threat Detection and Response (ITDR) Guide when deciding what authentication anomalies and identity compromise signals deserve escalation.
Risk and Threat Considerations
SMB relay is dangerous because it turns normal authentication into a transport mechanism for compromise. If an attacker can coerce or intercept an NTLM exchange and relay it to a host that trusts that authentication, they may gain access without ever knowing the password, which makes the attack attractive in environments with weak signing and reused administrative credentials.
Failure mechanism: The relay succeeds when the target host accepts the forwarded authentication and the environment allows that identity to do something valuable, such as access an admin share, start a remote service, or authenticate to a management interface.
Impact: A successful relay can create lateral movement, privilege abuse, or remote execution opportunities across systems that were assumed to be separated by policy rather than by technical enforcement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1021.002 — SMB/Windows Admin Shares | SMB relay and admin shares are core lateral movement mechanics in this attack path. |
| Recommendation — Hunt for SMB relay activity and harden remote admin share exposure. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | NTLM reduction and credential handling directly affect how authentication material is managed. |
| AC-6 — Least Privilege | Local admin reuse turns a relayed login into excessive privilege on other hosts. | |
| SC-13 — Cryptographic Protection | SMB signing is the cryptographic protection that prevents transparent session relay. | |
| Recommendation — Restrict legacy authenticators and rotate credentials that can be relayed. Remove excess local admin privilege and constrain administrative reach. Require SMB signing where supported to block relay of authentication traffic. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Network segmentation and service exposure reduction are central to limiting relay paths. |
| CIS-6 — Access Control Management | Removing shared local admin reuse and reducing unnecessary access are central mitigations. | |
| Recommendation — Separate management networks and restrict unnecessary SMB exposure. Eliminate shared administrative credentials and remove unneeded access paths. | ||
Practitioner Guidance
What to verify: Confirm where SMB signing is enforced versus merely supported, and check whether NTLM is still accepted on systems that handle sensitive administration or management traffic. If a host can be reached with relayed authentication and the resulting identity has administrative value, treat that path as a priority.
Decision rule: If a control only reduces the likelihood of relay but leaves the destination able to accept and act on relayed credentials, do not treat it as complete remediation. The highest-value fix is the one that removes both the relay path and the usefulness of the relayed identity.
Practitioner takeaway: The practical objective is to make relayed authentication useless, not merely inconvenient, by combining protocol protections, credential uniqueness, and segmentation that prevents one captured login from becoming a second-hop compromise.