Active Directory NTLM Relay Attacks
Hands-on Workshop (2 days)
From exploitation to mitigation: mastering NTLM relay end-to-end.
Glyfada,
Athens
October 2–3
10:00-16:00
Limited
seats
Join us for an exclusive limited-seat workshop on Active Directory NTLM relay attacks.
Register now and gain two days of hands-on instructor led training, guided HTB-powered labs and practical mastery of NTLM relay, from exploitation to deployable defenses. Workshop syllabus, venue information, and preparation details will be sent to all registered participants prior to the event.
(VAT excluded)
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
- Eager to expand your red-team toolkit with real-world NTLM relay tactics?
- Struggling to protect Active Directory from credential relay?
- Not sure how attackers really abuse NTLM authentication?
- Want to move beyond theory and actually defend your environment?
This is not another slide-based seminar. It’s a 2-day, scenario-driven workshop where you’ll get hands-on inside real NTLM relay attacks and vulnerabilities and learn how to exploit, detect, and defend against them in live Active Directory environments.
In collaboration with:
This workshop is delivered through custom-built, guided training by Cyber Helmets, enriched with Hack The Box Academy’s sophisticated labs and curated content.
What you’ll do
- Exploit NTLM relay paths to understand real attacker workflows
- Detect relays and post-relay activity with practical signals and tooling
- Implement layered mitigations that survive production constraints
- Leave with repeatable lab notes and a personal action plan for your environment
What you’ll gain
-
Deep understanding of NTLM
relay vulnerabilities and attacker techniques -
Practical exploitation exercises
in a controlled lab environment -
Proven defense strategies
you can immediately apply in your organization
Format & what’s included
- Live expert-led instruction
- Guided labs on real AD-style environments (via HTB Academy)
- Certificate of Completion to showcase your expertise
- Exclusive Cyber Helmets swag
Who it’s for
Blue Teamers, Purple Teamers, Windows/AD admins, Incident Responders, Security Engineers with basic AD/Windows familiarity. If you’ve read about NTLM relay but never executed it end-to-end, this is for you.
Requirements
- Familiarity with Windows authentication basics (high-level understanding is fine).
- Practical hands-on experience with command line on Windows and Linux (PowerShell + Bash)
- Solid understanding of Active Directory concepts, including users, groups, organizational units, and related structures.
- Knowledge of Active Directory enumeration techniques and common attack vectors.
- Comfort installing and running common lab tooling on Linux (Impacket, Responder, ntlmrelayx, etc)
Agenda: Your 2-day training journey.
Day 1 – Offense to Understand Risk
NTLM protocol refresher → Relay mechanics and tooling → Same-/cross-protocol relays → Post-relay paths (local admin, secrets extraction, lateral movement) → Lab blocks after each module.
Day 2 – Detection & Defense
Relayed traffic fingerprints → Log sources & correlations → Hardening playbook (SMB signing, EPA, mitigations without breaking stuff) → Blue-team labs → Personalization: draft your rollout checklist.
Instructor
The workshop will be led by Marios Pappas, an experienced penetration tester and red teamer with deep expertise in Active Directory security.
Join us for an exclusive limited-seat workshop on Active Directory NTLM relay attacks.
Register now and gain two days of hands-on instructor led training, guided HTB-powered labs and practical mastery of NTLM relay, from exploitation to deployable defenses. Workshop syllabus, venue information, and preparation details will be sent to all registered participants prior to the event.
2-day workshop – €490
(VAT excluded)
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
