🎯 NTLM relay

The items that name it 4

• From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
  writeupas classification.key entities2026-10-30
• Microsoft Windows NCSI Cross-Context Proxy Authentication Coercion - ZDI-26-708 - Part 1
  writeupas techniques2026-09-28

  Authentication captured from the service-context NCSI probe can be relayed to ADCS, Shadow Credentials, RBCD, or other privilege escalation paths on domain-joined machines

• Microsoft Windows NCSI Cross-Context Proxy Authentication Coercion - ZDI-26-708 - Part 2
  writeupas classification.key entities2026-09-28
• Pass-the-Passkey Family of Attacks
  writeupas classification.key entities2026-09-16