Microsoft NTLM Phase-Out: Detection & Migration Guidance — Threadlinqs Intelligence
As of 2026-05-30, Microsoft NTLM Phase-Out: Detection & Migration Guidance is a medium-severity advisory threat attributed to a Multiple (Russia, China, Iran, North Korea)-nexus actor, tracked by Threadlinqs Intelligence with 17 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 36 indicators of compromise.
Threat ID: TL-2026-0009 · Severity: MEDIUM · CVSS: 6.5 · Status: ACTIVE · Category: ADVISORY
Attribution: Multiple (Russia, China, Iran, North Korea) · Espionage
As Microsoft enforces NTLM deprecation across Windows environments (beginning Windows Server 2025 and Windows 11 24H2), organizations face a critical transition-period security gap where NTLM relay,
NTLM Detection & Monitoring During Deprecation: The Transition-Period Threat Surface
Why the Transition Period is the Most Dangerous Phase:
Microsoft's NTLM deprecation creates a paradox: the announcement signals to attackers that NTLM's days are numbered, accelerating exploitation of remaining NTLM dependencies before migration is complete. Organizations that have not yet migrated face concentrated attack pressure from adversaries racing to exploit NTLM before the window closes. Meanwhile, the migration itself introduces detection blind spots as authentication flows change.
NTLM Attack Surface — What Defenders Must Detect:
1. NTLM Relay Attacks (T1557.001):
- Attacker intercepts NTLM authentication handshake and relays it to another service
- Tools: Responder, ntlmrelayx, MultiRelay, PetitPotam, Inveigh
- Targets: SMB, LDAP, LDAPS, HTTP, MSSQL, ADCS (ESC8 — web enrollment relay)
- Detection: NTLM authentication where source IP ≠ expected client IP
- Critical: NTLM relay to ADCS (Active Directory Certificate Services) enables domain escalation
- PetitPotam forces domain controllers to authenticate to attacker-controlled SMB share
2. NTLM Downgrade Attacks:
- Attacker forces NTLMv2 authentication to downgrade to NTLMv1 (weaker, crackable)
- NTLMv1 uses DES encryption — crackable in hours on modern GPUs
- Group Policy: LmCompatibilityLevel controls NTLMv1 vs NTLMv2 enforcement
- Detection: Event ID 4624 with NtlmV1 in AuthenticationPackageName field
- Any NTLMv1 in a modern environment = either misconfiguration or active downgrade attack
3. Pass-the-Hash (T1550.002):
- Attacker uses captured NTLM hash directly for authentication without cracking
- Tools: Mimikatz, CrackMapExec, Evil-WinRM, Impacket
- NTLM hash extracted via LSASS dump, SAM database, DCSync, or network capture
- Detection: NTLM LogonType 3 (network) from workstation to server with no preceding interactive logon
- Kerberos migration eliminates PtH entirely — NTLM hash is useless against Kerberos-only systems
4. LLMNR/NBT-NS Poisoning (T1557.001):
- Attacker responds to LLMNR (UDP 5355) and NBT-NS (UDP 137) broadcast queries
- Victim sends NTLM credentials to attacker-controlled system
- Tools: Responder, Inveigh — capture NTLMv2 hashes for offline cracking or relay
- Detection: LLMNR/NBT-NS responses from non-DNS servers
- Mitigation: Disable LLMNR and NBT-NS via GPO (first step in NTLM hardening)
5. Coerced Authentication (PetitPotam, PrinterBug, DFSCoerce):
- Attacker forces a Windows service to authenticate to attacker-controlled share
- PetitPotam: MS-EFSRPC → forces machine account NTLM auth
- PrinterBug: MS-RPRN → forces print spooler NTLM auth
- DFSCoerce: MS-DFSNM → forces DFS NTLM auth
- ShadowCoerce: MS-FSRVP → forces file server NTLM auth
- Detection: Outbound NTLM authentication from domain controllers/servers to workstation IPs
6. NTLM Hash Harvesting via Malicious Documents/Links:
- UNC path in document (\\attacker\share) forces NTLM authentication
- .URL, .LNK, .SCF files with UNC paths trigger automatic NTLM auth
- Outlook preview pane rendering remote images triggers NTLM auth
- Detection: Outbound SMB connections (port 445) to external/unusual IPs
Legacy NTLM Dependency Discovery:
Before disabling NTLM, organizations must discover what still requires it:
1. NTLM Authentication Auditing:
- Enable: Audit Policy → Logon/Logoff → Audit Logon Events (Success + Failure)
- Event ID 4624 with AuthenticationPackageName 'NTLM' = active NTLM usage
- Windows Server 2025: NTLM audit mode logs all NTLM without blocking
- Group Policy: Network security: Restrict NTLM → Audit all in this domain
2. Common Legacy NTLM Dependencies:
- Older web applications using Windows Integrated Authentication (NTLM instead of Negotiate)
- Legacy printers and multifunction devices using NTLM for scan-to-folder
- Older NAS/SAN devices authenticating via NTLM
- Non-domain-joined devices that can only use NTLM (not Kerberos)
- Cross-forest trusts using NTLM when Kerber
Weaknesses (CWE)
CWE-287, CWE-294, CWE-327
Target sectors: All Sectors, Enterprise, Government, Healthcare, Financial Services, Education
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 17 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 36 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
ADVISORY, MEDIUM, threat intelligence, cybersecurity, T1003.003, T1649, T1550.002, T1557.001, T1187, T1557, T1003, T1003, T1003, T1110