DFS Coerced Authentication NTLM Credential Harvesting
This detection identifies potential NTLM relay activity by correlating named pipe access to \netdfs (commonly abused in DFSCoerce attacks) with NTLM challenge traffic within a short time window. Attackers can exploit this technique to coerce authentication and perform NTLM relay, enabling lateral movement or privilege escalation in Active Directory environments.
Microsoft Sentinel (KQL)
