Remove Backups Remove DNS Remove Whitepaper
article thumbnail

The Renaissance of NTLM Relay Attacks: Everything You Need to Know

Security Boulevard

PetitPotam abuses several functions in the Encrypting File System (EFS) service, such as EfsRpcOpenFileRaw, which opens a file in an arbitrary path for backup/restore. This is the infamous ADCS ESC8 that Will Schroeder and Lee Chagolla-Christensen disclosed in their Certified Pre-Owned whitepaper.