domains / families / security / coercing-authentication-with-coercer-petitpotam

coercing-authentication-with-coercer-petitpotam

separate

Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer (MS-RPRN, MS-DFSNM, MS-FSRVP, MS-EVEN) via Coercer's scan/coerce/fuzz modes, feeding the coerced NTLM auth into a relay against AD CS Web Enrollment (ESC8), LDAP (RBCD), or SMB. Use in authorized engagements to complete a coercion-relay chain against a Domain Controller, or to validate coercion detections and signing/EPA mitigations.

When to use

• To complete an ESC8/ESC11 chain by forcing a DC to authenticate to a relay
• To trigger machine authentication for NTLM relay to LDAP (RBCD) or SMB
• When a relay target is identified but no inbound authentication is occurring naturally
• During detection engineering to generate coercion telemetry for blue-team tuning
• To validate that DCs/servers are patched and that relay mitigations (signing/EPA) hold

When not to use

• unauthorized use
• testing without explicit written authorization

Skill page

Source