Potential NTLM Relay Attack against a Microsoft Configuration Manager Site Server

Cortex XDR Analytics Alert Reference by Alert name
Product
Cortex XDR
Last date published
2026-03-10
Category
Analytics Alert Reference
Index by
Alert name

Synopsis

Activation Period

14 Days

Training Period

30 Days

Test Period

10 Minutes

Deduplication Period

1 Day

Required Data

  • Requires:
    • XDR Agent

Detection Modules

Identity Analytics

Detector Tags

Microsoft SCCM Analytics

ATT&CK Tactic

ATT&CK Technique

Severity

Informational

Description

Multiple NTLM authentications were made to the same Microsoft Configuration Manager site server and user from different IPs in a short period of time.
This might indicate a potential NTLM Relay attack.

Attacker's Goals

An attacker may coerce the SCCM site server to authenticate to a malicious host and relay it to escalate privileges and move laterally across site systems.

Investigative actions

  • Ensure that the alerted host is not a NAT device or proxy that replicates or forwards network traffic as part of its expected operational behavior.
  • Check if the protocols used are vulnerable to an NTLM relay attack (e.g. LDAP, SMB).
  • Ensure that SMB signing is enabled in the case of a possible SMB relay attack.
  • Check for network activity to and from the suspicious IP address to verify if it is a compromised machine.
  • Monitor closely the actions of the potentially compromised user account for any anomalous behavior, especially suspicious SCCM-related activity occurring near the time of the alert.

Variations

Potential NTLM Relay Attack against a Microsoft Configuration Manager Site Server using a vulnerable package

Synopsis

ATT&CK Tactic

ATT&CK Technique

Severity

Low

Description

Multiple NTLM authentications were made to the same Microsoft Configuration Manager site server and user from different IPs using a vulnerable NTLM package in a short period of time.
This might indicate a potential NTLM Relay attack.

Attacker's Goals

An attacker may coerce the SCCM site server to authenticate to a malicious host and relay it to escalate privileges and move laterally across site systems.

Investigative actions

  • Ensure that the alerted host is not a NAT device or proxy that replicates or forwards network traffic as part of its expected operational behavior.
  • Check if the protocols used are vulnerable to an NTLM relay attack (e.g. LDAP, SMB).
  • Ensure that SMB signing is enabled in the case of a possible SMB relay attack.
  • Check for network activity to and from the suspicious IP address to verify if it is a compromised machine.
  • Monitor closely the actions of the potentially compromised user account for any anomalous behavior, especially suspicious SCCM-related activity occurring near the time of the alert.