DFSCoerce NTLM Forced Authentication via DFSNM RPC

Lacey Cochrane@NullVectorX

•updated Sep 25, 2026•2•0•3

Detects the abuse of the DFS Namespace Management (DFSNM) interface by monitoring calls to NetrDfsAddStdRoot (opnum 12) and NetrDfsRemoveStdRoot (opnum 13). An adversary can trigger these functions to coerce a Windows host to authenticate to an attacker-controlled remote host using NTLM, facilitating NTLM relay attacks.