Security News > 2021 > July > Microsoft shares mitigations for new PetitPotam NTLM relay attack
Microsoft has released mitigations for the new PetitPotam NTLM relay attack that allows taking over a domain controller or other Windows servers.
PetitPotam is a new method that can be used to conduct an NTLM relay attack discovered by French security researcher Gilles Lionel.
The new attack uses the Microsoft Encrypting File System Remote Protocol to force a device, including domain controllers, to authenticate to a remote NTLM relay controlled by a threat actor.
After news of the PetitPotam NTLM relay attack broke yesterday, Microsoft published a security advisory with recommendations for organizations to defend against threat actors using the new technique on domain controllers.
"PetitPotam takes advantage of servers where Active Directory Certificate Services is not configured with protections for NTLM Relay Attacks" - Microsoft.
Microsoft's advisory is clear about the action to prevent NTLM relay attacks but does not address the abuse of the MS-EFSRPC API, which would need a security update to fix.
News URL
Related news
- CISA warns of Microsoft Streaming bug exploited in malware attacks (source)
- Hackers steal Windows NTLM authentication hashes in phishing attacks (source)
- Warning: Thread Hijacking Attack Targets IT Networks, Stealing NTLM Hashes (source)
- DarkGate Malware Exploited Recently Patched Microsoft Flaw in Zero-Day Attack (source)
- New Phishing Attack Uses Clever Microsoft Office Trick to Deploy NetSupport RAT (source)
- Quick Glossary: Cybersecurity Attack Response and Mitigation (source)
- 17,000+ Microsoft Exchange servers in Germany are vulnerable to attack, BSI warns (source)
- Microsoft still unsure how hackers stole MSA key in 2023 Exchange attack (source)
- Microsoft fixes two Windows zero-days exploited in malware attacks (source)
- Week in review: Palo Alto Networks firewalls under attack, Microsoft patches two exploited zero-days (source)