NTLM

A legacy Windows authentication protocol vulnerable to relay and pass-the-hash.

New Technology LAN Manager is a challenge-response authentication suite that Microsoft retained for backward compatibility long after Kerberos became the default in Windows domains. It is susceptible to NTLM relay, where an attacker forwards a victim's authentication to another service, and to pass-the-hash, where a captured password hash is reused without cracking it. Because the hash functions as a credential, stealing it from memory grants access directly. Kerberos is preferred since it uses time-limited tickets and mutual authentication, and disabling legacy NTLM reduces these attack paths.