PETITPOTAMPetitPotam

Public NTLM authentication coercion technique and proof-of-concept tool that abuses the Encrypting File System Remote Protocol (MS-EFSRPC) to force a Windows server, typically a domain controller, to authenticate with its machine account to an attacker-controlled host. Chained with NTLM relay to Active Directory Certificate Services Web Enrollment (ESC8), it lets an attacker obtain a certificate for the domain controller identity without knowing its password; Microsoft's KB5005413 covers mitigation of this relay path. In October 2026 Microsoft reported its use in a help desk impersonation intrusion: after Teams social engineering and remote access, the attacker coerced domain controller authentication with PetitPotam, relayed it to AD CS through ESC8 and used the issued certificate for Kerberos authentication. No actor attribution is given. Dual-use: it is also a common red-team technique.