Lion Cipher Lab
Detect NTLM relay and coerced authentication (the PetitPotam / PrinterBug pattern)
- SOC Analyst / Blue Team
- Advanced
- ~60 min
- Free · no account required
Why it matters
Coerced authentication plus NTLM relay is one of the most reliable ways an attacker turns a foothold into full domain control — force a Domain Controller to authenticate to you, relay that authentication to Active Directory Certificate Services, walk away with a certificate that impersonates the DC. It has been used in real intrusions and it is quiet: done right, the logs barely twitch. A SOC analyst who can recognize the faint signal AND who understands that the real fix is signing, channel binding, and killing NTLM — not a detection rule — is worth their weight. This lab builds both halves…
What you'll learn
- Threat hunting in Windows Security logs
- Understanding coerced authentication (PetitPotam / PrinterBug)
- Understanding NTLM relay to AD CS
- Filtering events with Get-WinEvent and XPath
- Reading Logon Type 3 / NTLM 4624 records
- Knowing when prevention beats detection
Steps in this lab
- The attack in one breath — coercion, then relay
- When you would reach for this — and the hard truth up front
- Build your hunting sample (no domain required)
- Signal 1 — NTLM where you expected Kerberos, over the network
- Signal 2 — a machine account ($) logging on to the wrong place
- The AD CS side — where the relay cashes out (explained, not run)
- The real fix — controls that make the attack FAIL, not just log
- False positives — the legitimate look-alikes you must not page on
- When NOT to rely on this — and what to do instead