Protocol

NTLM

An older Windows authentication protocol, still widely used and easy to relay.

NTLM proves identity with a challenge and response derived from the password hash. Attackers capture or relay those exchanges to log in as the victim elsewhere. Microsoft is phasing NTLM out in favour of Kerberos.