NTLM coercion & relay

When it applies

You're on an AD network (unauthenticated or with a foothold) and want to move laterally or escalate without cracking passwords. If SMB signing isn't enforced (or you target LDAP/ADCS), you can relay a victim's NTLM authentication to a service and act as them.

Why it works

NTLM authentication isn't bound to the channel: if you can make a machine/user authenticate to you (coercion or poisoning), you forward that authentication to another service. Without signing (SMB) or channel binding (LDAP/HTTP), the target accepts it, and you get access as the coerced identity — often a computer account with local admin elsewhere, or a DC to ADCS.