A new NTLM (New Technology LAN Manager) relay attack has been uncovered using Microsoft’s distributed file system. The attack allows a threat actor to fully compromise a Windows domain. Many organizations use Microsoft Active Directory Certificate Services to authorize users, however, this service is vulnerable to NTLM relay attacks. In these attacks, threat actors force or coerce a domain controller to authenticate a NTLM account under the attackers’ control. The authentication process forwards the request to the Active Directory Certificate Services via HTTP to gain a ticket-granting ticket (TGT). With this TGT, they can assume the identity of any device on the network, including a domain controller. To coerce a remote server to authenticate the malicious NTLM relay, threat actors could use multiple potentially vulnerable protocols such as MS-RPRN, MS-EFSRPC (PetitPotam), and MS-FSRVP. While Microsoft has patched some of these protocols to prevent unauthenticated coercion, bypasses are frequently found that allow the protocols to be abused. This week, Filip Dragovic released a proof-of-concept (PoC) script for a new NTLM relay attack called “DFSCoerce”. The DFSCoerce attack uses the MS-DFSNM protocol, which allows the Windows Distributed File System (DFS) to be managed over an RPC interface. Security researchers who have tested this new NTLM relay attack have reported that it allows a user with limited access to a Windows domain to become a domain administrator. At this time, researchers state that the best way to protect against the DFSCoerce attack is to follow Microsoft’s advisory on mitigating the PetitPotam NTLM relay attacks. These mitigation methods include disabling NTLM on domain controllers, enabling Extended Protection for Authentication and signing features, and using the Windows built-in RPC Filters or RPC Firewall to prevent servers from being coerced. However, it is not known yet whether blocking the DFS RPC connection would cause issues on a network.