What is it?
SMB Relay is an attack pattern in which relayed Windows authentication is used against SMB. The learning goal is to identify the trust boundary being abused, the attacker’s sequence, and the telemetry that records it.
How it works in plain English
Use this three-part model to understand the attack without memorizing a tool name.
Devices trust routing, naming, addressing, session state, or protocol messages from the network.
The attacker injects, relays, captures, floods, downgrades, or redirects traffic.
Examine both sides of the conversation and look for impossible topology, timing, volume, identity, or protocol combinations.
Worked example: how the sequence may look
Access to or influence over the relevant Windows, SMB environment.
Trigger the condition that enables smb relay.
Flow, packet, DNS, DHCP, proxy, firewall, VPN, IDS, router, and load-balancer telemetry.
Baseline the affected identity, host, application, service, or protocol.
If successful, the attacker may continue with Network Sniffing. This is a possibility, not a guaranteed next step.
This is a defensive learning scenario. Real incidents vary, and the listed outcome is only one possible path.
Why do attackers use it?
Advance an objective associated with discovery / credential access / impact.
Exploit a weak control, unsafe default, exposed service, trusted relationship, or human decision.
Create access, gain privilege, evade defenses, steal information, or disrupt operations.
Prerequisites
Access to or influence over the relevant Windows, SMB environment.
Knowledge of the target’s technology, identities, configuration, or user behavior.
A weakness, misconfiguration, exposed interface, stolen secret, or social opportunity.
A path to observe success and continue toward the objective.
Attack path possibilities
Attack chains are not fixed. These links show common possibilities to investigate before and after this behavior.
Probes identify hosts, ports, protocols, and services.
Concept Rogue DHCPAn unauthorized DHCP server supplies malicious network configuration.
Concept Evil Twin Wi-FiA rogue access point imitates a trusted wireless network.
Concept ARP SpoofingForged ARP messages redirect local traffic through an attacker.
Network traffic is captured to collect credentials, sessions, or sensitive data.
T1557.001 NTLM RelayCaptured NTLM authentication is forwarded to another service.
T1563 Session HijackingAn established application or remote-access session is taken over.
T1110.004 Credential StuffingUsername and password pairs stolen elsewhere are replayed against a new service.
Step-by-step attack flow
Reconnoiter the target and identify the exposed trust boundary.
Prepare the infrastructure, lure, input, credential, or payload required.
Trigger the condition that enables smb relay.
Confirm access or effect while attempting to avoid controls.
Use the result for follow-on access, execution, collection, movement, persistence, or impact.
Remove evidence, rotate infrastructure, or repeat against other targets.
MITRE ATT&CK mapping
ATT&CK is updated over time. Verify the live technique before operationalizing a detection.
Logs and artifacts
Flow, packet, DNS, DHCP, proxy, firewall, VPN, IDS, router, and load-balancer telemetry.
Connection-rate, protocol-field, route, name-resolution, and source-distribution anomalies.
Endpoint network events that connect suspicious traffic to a process and user.
Realistic log examples
These records use realistic field names and formats but synthetic organizations, users, addresses, and identifiers. A single event is not proof; correlate time, identity, source, target, and the resulting action.
Protocol-level network metadata suitable for volume, beaconing, scanning, and tunneling analysis.
# conn.log
ts=1784211621.944 uid=Cq91mV3j id.orig_h=10.24.18.77 id.orig_p=51542
id.resp_h=198.51.100.24 id.resp_p=443 proto=tcp service=ssl
duration=0.182 orig_bytes=517 resp_bytes=421 conn_state=SF
# dns.log
query=aj3k2f9d.data-sync.example qtype_name=TXT rcode_name=NOERRORBaseline the affected identity, host, application, service, or protocol.
IDS alert plus flow context; validate signature matches against packet and endpoint evidence.
{"timestamp":"2026-07-16T14:20:11.428Z","event_type":"alert",
"src_ip":"203.0.113.48","src_port":51542,"dest_ip":"10.24.18.20",
"dest_port":443,"proto":"TCP","alert":{"signature_id":2024218,
"signature":"ET WEB_SERVER Possible Web Exploit Attempt","severity":2},
"http":{"hostname":"portal.corp.example","url":"/api/v1/search"}}Detect rare combinations of source, target, action, timing, volume, and result.
Failed authentication; useful for guessing, spraying, exposed remote services, and account targeting.
2026-07-16T14:22:31Z EventID=4625 Computer=DC01.corp.example
TargetUserName=j.singh TargetDomainName=CORP LogonType=3
AuthenticationPackageName=NTLM WorkstationName=WKSTN-442
IpAddress=203.0.113.48 IpPort=51842
Status=0xC000006D SubStatus=0xC000006A FailureReason="Unknown user name or bad password"Correlate identity, endpoint, network, application, and control-plane evidence across the sequence.
Remote authentication and PAM outcome with source address and account.
Jul 16 14:22:33 web02 sshd[24817]: Failed password for invalid user backup
from 203.0.113.48 port 51842 ssh2
Jul 16 14:22:37 web02 sshd[24817]: Failed password for deploy
from 203.0.113.48 port 51842 ssh2Prioritize activity followed by successful access, privilege change, execution, or data movement.
- Who or what identity acted?
- From which device, process, IP, or workload?
- What target and operation were involved?
- Did it fail, succeed, or change state?
- What correlated event happened immediately before and after?
Detection logic / SIEM queries
Baseline the affected identity, host, application, service, or protocol.
Detect rare combinations of source, target, action, timing, volume, and result.
Correlate identity, endpoint, network, application, and control-plane evidence across the sequence.
Prioritize activity followed by successful access, privilege change, execution, or data movement.
FROM security_events
WHERE event_time > now() - 30m
AND behavior = "SMB Relay"
GROUP BY source, target, user
HAVING count(*) > baseline(source, target, user)
OR rare(action, source, target) = true
CORRELATE WITH success, privilege_change, execution, data_accessMitigations
Reduce exposed attack surface and remove unused services, identities, features, and trust relationships.
Apply least privilege, strong authentication, secure defaults, segmentation, and timely patching.
Validate untrusted input and independently authorize sensitive operations.
Centralize and protect relevant logs; test detections with controlled simulations.
Maintain a response playbook for containment, credential rotation, evidence preservation, and recovery.
Real-world examples
SMB Relay appears in opportunistic campaigns and targeted intrusions when the required condition exists.
Real incidents usually combine it with credential theft, phishing, exploitation, persistence, or exfiltration.
The best case studies describe the full attack chain rather than an isolated tool or indicator.
Common questions
01What makes SMB Relay possible?
A trust assumption fails: an identity, input, component, network message, user decision, or software relationship is accepted without enough verification.
02What should a defender collect first?
Start with logs closest to the decision point, then add identity, endpoint, network, and control-plane context.
03How should I study this attack?
Learn the concept, identify prerequisites, map observable steps, write a detection hypothesis, and validate it safely in a lab.