Top 2026 2FA & AiTM Detection: NTLM/Kerberos Relay Supporting On-Prem AiTM Posit

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•2

This rule detects activities indicative of an attacker attempting to establish an adversary-in-the-middle (AiTM) position within an on-premises network. It flags potential NTLM relay attempts (via loopback or invalid workstation indicators) and unauthorized name resolution spoofing (LLMNR/NBT-NS) used to intercept and relay authentication traffic for MFA bypass or credential theft.