PetitPotam-style outbound SMB coercion from Exchange server (MS-EFSR)

Ethan Andrews@eandrews

•updated Aug 17, 2026•10•1•16

Detects an Exchange server initiating outbound SMB (port 445) connections to non-private (external) IP addresses. This behavior is highly characteristic of PetitPotam (MS-EFSR) coercion, where an attacker forces the server to authenticate to an external, attacker-controlled UNC path to capture NTLM authentication credentials or relay them to other network resources.