Forced Authentication

Forced Authentication (ATT&CK T1187) causes a Windows user or system to initiate SMB or WebDAV authentication to an attacker-controlled endpoint, for example after opening a remote-resource lure or through an authentication-coercion procedure. The resulting NTLM challenge-response can be captured and may be cracked offline; an authentication exchange may also be relayed when the target service and its protections permit it. This record demonstrates a direct WebDAV UNC request. Client policy, WebClient availability, network reachability, and NTLM restrictions determine whether any authentication is sent; a request does not prove capture, cracking, or relay.