ntlmrelayx

Reported Context (2)

Custom noPac scripts, certipy, ntlmrelayx (with a DCSync variant), PKINITtools Exposed Directory Reveals Aurora Affiliate’s Attacks on More Than 20 Organizations
With tailscaled running and the node enrolled, socksportfwd binds port 8888 on the compromised host and forwards to a machine on the tailnet running ntlmrelayx. BOFScale Runs Tailscale In-Memory to Route C2 Traffic Through CDN-Fronted WebSockets

Malware (1)

MITRE ATT&CK (17)

Vendors (1)

Products (15)

Tools (21)

Industries (8)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.