NTLM Relay Pass-the-Token Access Token Manipulation via SMB - T1134

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects anomalous SMB NTLM authentication traffic indicative of relay attacks, where an attacker intercepts an authentication request and relays it to another SMB service.