A coercion technique that forces a remote server to authenticate to another system using NTLM. The attack abuses MS-EFSRPC to trigger authentication that can then be relayed, especially to certificate services, where it may lead to impersonation or domain compromise.
How PetitPotam Works
PetitPotam is a coercion technique, not a privilege escalation bug in isolation. It abuses MS-EFSRPC to make a target system initiate outbound NTLM authentication toward an attacker-controlled or attacker-influenced endpoint, turning the victim into the party that presents the credentials.
The security significance is the forced authentication path itself. Once a system can be induced to authenticate, the attacker can try to relay that NTLM exchange to a downstream service that accepts it, especially where the service is configured to trust NTLM and lacks protections against relay.
This is why PetitPotam is often discussed alongside NTLM relay rather than as a standalone protocol flaw. The coercion step creates the opportunity; the relay step converts that opportunity into unauthorized access when the destination service is reachable and permissive.
Why It Is Dangerous
The technique becomes high impact when the relayed authentication reaches a sensitive service such as certificate services. In that case, the attacker may obtain credentials or enrollments that let them impersonate the coerced principal, and in some environments that can lead to broad domain compromise.
Its practical danger is that the victim appears to be initiating a legitimate authentication flow. That reduces friction for the attacker, because many security controls focus on inbound login attempts while the abuse is happening through outbound authentication and protocol trust.
PetitPotam also demonstrates a broader design weakness: if an environment allows a server to authenticate outward on demand and trusts that authentication too much, the security boundary can be crossed without traditional password theft or interactive login.
Common Preconditions and Attack Path
PetitPotam usually depends on reachable RPC exposure, permissive NTLM usage, and a downstream target that accepts relayed authentication. The attack path is often: coerce authentication, capture the NTLM exchange, relay it, and use the resulting access to perform a higher-value action.
Certificate infrastructure is especially important because certificate enrollment or related administrative pathways can become a durable foothold. Once a trusted certificate or equivalent impersonation capability is obtained, the attacker may pivot into broader identity abuse rather than relying on the original relay session.
The technique is therefore best understood as a chain of trust abuse. MS-EFSRPC is the trigger, NTLM is the transport, and the vulnerable destination service is the point where the coerced authentication becomes a security failure.
Defensive Implications
Defenders should treat PetitPotam as a signal to review where NTLM is still accepted, where outbound authentication can be coerced, and which services are still willing to trust relayed credentials. Reducing relayability matters as much as reducing the coercion surface.
It is also important to harden certificate services and closely related identity infrastructure, because those systems often turn a single relayed login into a much larger trust failure. Detection should look for unusual RPC-triggered authentication patterns, especially when a server begins authenticating to an unexpected host or service.
For a deeper view of how compromised machine and service credentials become breach fuel, see The 52 NHI breaches Report and 52 NHI Breaches Analysis.
Risk and Threat Considerations
PetitPotam creates a material relay risk because the attacker does not need to steal a password first, only to force a system to authenticate in a way that can be relayed. That makes it attractive for abuse against environments that still trust NTLM and expose sensitive downstream services.
Failure mechanism: An attacker coerces a server into sending NTLM authentication to a controlled listener, then relays that authentication to another service that accepts it as proof of trust.
Impact: The relayed session can unlock unauthorized access, certificate abuse, impersonation, and in the worst case a path to domain compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS Control 6 — Access Control Management | PetitPotam abuses relayed authentication to gain unauthorized access. |
| CIS Control 8 — Audit Log Management | Detection relies on spotting abnormal server-initiated authentication and relay indicators. | |
| Recommendation — Restrict authentication paths and revoke unnecessary access routes that enable relay abuse. Monitor logs for unusual outbound authentication from servers and investigate relay patterns. | ||
| NIST CSF 2.0 | PR.AC-1 — Identity and Credentials Are Issued, Managed, Verified, Revoked, and Audited | The attack exploits trust in authentication exchanges and credential-bearing sessions. |
| DE.CM-1 — Networks and Network Services Are Monitored to Find Potential Cybersecurity Events | PetitPotam is often detected through abnormal outbound authentication and relay activity. | |
| PR.AC-4 — Access Permissions and Authorizations Are Managed, Incorporated, and Enforced | Relayed NTLM becomes dangerous when downstream services accept the coerced authorization. | |
| Recommendation — Manage credentials and authentication trust paths to limit abuse of coerced logon traffic. Monitor network authentication flows for anomalous server-initiated connections and relay attempts. Enforce service authorization boundaries so relayed authentication cannot grant unintended access. | ||
| MITRE ATT&CK | T1187 — Forced Authentication | PetitPotam is a coercion technique that forces a target to authenticate to another system. |
| T1557 — Adversary-in-the-Middle | The attack commonly relies on intercepting and relaying NTLM authentication. | |
| Recommendation — Map coercion activity to T1187 and hunt for forced authentication followed by relay behavior. Detect relay infrastructure and block man-in-the-middle relaying of authentication traffic. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secrets and Credential Management | The attack path often ends in abused machine or service credentials and relayable identity material. |
| Recommendation — Reduce reliance on reusable authentication material that can be coerced or relayed. | ||
Practitioner Guidance
What to watch for: Treat unexpected outbound authentication from servers, especially toward unusual hosts or relay infrastructure, as a serious signal. The key judgement is not only whether NTLM is present, but whether a service can be made to authenticate in a context the organisation did not intend.
Governance implication: Owners of certificate services, legacy RPC interfaces, and NTLM-dependent systems should be explicit about which protocols remain allowed and which trust relationships are still acceptable. That ownership decision matters because PetitPotam exploits the gap between a technically working authentication path and a security-approved one.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
