Microsoft has released security updates that block the PetitPotam NTLM relay attack that allows a threat actor to take over a Windows domain. In July, security researcher GILLES Lionel, aka Topotam, disclosed a new method called PetitPotam that forces a domain controller to authenticate against a threat actor’s server using the MS-EFSRPC API functions.

Read full article on Bleeping Computer