Wiki › Techniques, Tactics & Procedures (TTPs) › Lateral Movement › SMB Relay Attacks

SMB Relay Attacks

2 min read

Jump to:

Overview

SMB Relay Attacks are a form of man-in-the-middle attack targeting the Server Message Block (SMB) protocol, commonly used for file sharing and inter-process communication in Windows environments. Adversaries leverage this technique to intercept and relay authentication requests, enabling unauthorized access and lateral movement within a network. It is frequently employed during the initial access and lateral movement phases of an attack lifecycle to escalate privileges and expand control.

Attack Objective

Gain unauthorized access by relaying legitimate authentication credentials
Supports Initial Access, Lateral Movement, Privilege Escalation, and Persistence stages
Advances attacker position by bypassing authentication mechanisms without cracking credentials

How the Technique Works

In an SMB Relay Attack, the adversary intercepts an authentication request from a legitimate client to an SMB server and relays it to another server or service. The attacker acts as an intermediary, forwarding the authentication challenge and response between the client and target without decrypting credentials. By relaying these credentials, the attacker can authenticate to the target system using the victim’s privileges, effectively impersonating the user and gaining unauthorized access.

Common Methods & Variations

Classic SMB relay on local networks using man-in-the-middle positioning
Relay attacks targeting SMB over TCP/IP or SMB signing-disabled environments
Variants targeting cloud-based SMB services or hybrid environments
Use of living-off-the-land binaries and protocols versus custom relay tools

Indicators of Compromise (IOCs)

Unusual SMB authentication attempts from unexpected hosts or accounts
Authentication failures or repeated challenge-response cycles in SMB logs
Network traffic showing SMB negotiation between non-standard endpoints
Endpoint logs indicating lateral authentication without corresponding user activity

Detection Strategies

Monitoring SMB authentication logs and network traffic for anomalies
Behavioral detection focusing on unusual authentication patterns and lateral connections
Correlation of authentication events with endpoint and network telemetry

Mitigation & Prevention

Enforce SMB signing and encryption to prevent interception and relay
Disable SMBv1 and restrict SMB traffic to trusted networks
Implement network segmentation and strict access controls
Use multi-factor authentication and limit privileged account usage

Response Considerations

Immediately isolate affected systems to prevent further lateral movement
Investigate authentication logs and network traffic to identify scope and entry points
Reset compromised credentials and review SMB configuration settings
Harden network defenses and apply patches to vulnerable SMB implementations

Related Techniques

Pass-the-Hash and Pass-the-Ticket attacks
Credential Dumping and Brute Force techniques
Lateral Movement via Remote Services

Mapping & References

MITRE ATT&CK Tactic/Technique: Initial Access (T1078), Lateral Movement (T1021.002), Credential Access (T1003)
Public research and advisories on SMB vulnerabilities and relay attacks from security organizations

Tags: Attack Lifecycle Authentication Relay Credential Access Cybersecurity Techniques lateral movement Man-in-the-Middle MITRE ATT&CK Network Attacks SMB Relay Windows Security