NTLM Relay via Adversary-in-the-Middle

Adversaries position themselves on a target network and use LLMNR/NBT-NS/mDNS poisoning or DHCPv6-based DNS/WPAD redirection to induce NTLM authentication to an attacker-controlled listener. The challenge-response can be relayed to a reachable target service only when its configured protections permit relay; resulting access is limited to the relayed account's rights.