NTLM relay is a classic: the attacker doesn't crack a hash - they relay a victim's authentication to another service and act as them.
The chain
- Coerce authentication - trick a machine or user into authenticating to the attacker (a poisoned link, a share path, or coercion tricks like PetitPotam that force a server to auth).
- Relay that NTLM auth to a target service that accepts it (LDAP, SMB, AD CS web enrollment).
- Act as the victim on that service - e.g. relay a Domain Controller's auth to AD CS to mint a certificate, then become Domain Admin.
Poisoning tools (Responder) plus relay tools (ntlmrelayx) make this a well-worn path.
Detect it
- LLMNR/NBT-NS/mDNS responses on the network from unexpected hosts (poisoning).
- Authentication from a host to a service it never normally uses, especially machine accounts.
- AD CS certificate enrollment anomalies (relayed to ESC8).
Prevent it
- Disable LLMNR / NBT-NS and require DNS.
- Enforce SMB signing and LDAP signing/channel binding - signed sessions can't be relayed.
- Harden AD CS web enrollment (EPA, disable NTLM there).
- Reduce coercion surface (patch PetitPotam-style vectors).