Wiki › Techniques, Tactics & Procedures (TTPs) › Privilege Escalation › Credential Relay for Privilege Escalation

Credential Relay for Privilege Escalation

2 min read

Jump to:

Overview

Credential Relay for Privilege Escalation is a technique where adversaries leverage intercepted or harvested authentication tokens or credentials to impersonate users with higher privileges. This method plays a critical role in the attack lifecycle by enabling attackers to escalate their access rights without directly compromising credentials, facilitating deeper system control and lateral movement.

Attack Objective

Gain elevated privileges to access restricted resources or perform privileged actions
Supports the Privilege Escalation and Lateral Movement stages of the attack lifecycle
Advances the attacker’s position by enabling access to sensitive systems or data without requiring credential theft or brute force

How the Technique Works

Adversaries capture authentication tokens, such as Kerberos tickets or NTLM hashes, from compromised systems and reuse or relay them to authenticate as higher-privileged users on other systems. By forwarding these credentials within a network, attackers bypass direct credential exposure and elevate their privileges through trusted authentication mechanisms.

Common Methods & Variations

Relaying NTLM authentication requests to gain access to privileged accounts
Using Kerberos ticket forwarding or ticket-granting ticket (TGT) theft to impersonate users
On-premises network relay attacks versus cloud identity token misuse
Living-off-the-land techniques leveraging native OS tools and protocols versus custom relay tools

Indicators of Compromise (IOCs)

Unusual authentication attempts or ticket requests from unexpected hosts
Authentication logs showing repeated or anomalous use of delegated credentials
Endpoint events indicating token theft or suspicious process activity related to credential access
Network traffic patterns consistent with relay attacks, such as multiple authentication handshakes without corresponding user activity

Detection Strategies

Monitoring authentication logs from domain controllers and identity providers
Behavioral detection focusing on anomalous credential use and lateral authentication patterns
Correlation of endpoint process activity with network authentication events
Use of honeypots or decoy accounts to identify unauthorized credential relay attempts

Mitigation & Prevention

Enforce strong authentication protocols, such as Kerberos with constrained delegation
Implement network segmentation and restrict lateral authentication flows
Use multi-factor authentication to reduce reliance on relayable credentials
Apply least privilege principles and regularly audit delegated permissions
Deploy endpoint protections to detect and block credential dumping tools

Response Considerations

Immediately isolate affected systems to prevent further credential relay
Investigate authentication logs to identify scope and timeline of credential misuse
Reset compromised credentials and revoke delegated tickets or tokens
Review and harden delegation and authentication configurations post-incident

Related Techniques

Credential Dumping – upstream technique for obtaining credentials
Pass the Hash – related technique involving reuse of hashed credentials
Kerberos Ticket Manipulation – related to ticket forging and reuse
Lateral Movement – subsequent actions enabled by escalated privileges

Mapping & References

MITRE ATT&CK Tactic: Privilege Escalation, Lateral Movement
MITRE ATT&CK Technique: T1550 (Use Alternate Authentication Material), T1075 (Pass the Ticket)
Public research on NTLM relay attacks and Kerberos ticket abuse
Security advisories on delegation and authentication protocol hardening

Tags: Authentication Attacks Credential Relay Cyber Attack Techniques identity and access management Incident Response lateral movement privilege escalation Security Monitoring