IPv6 attacks: How to harden active directory

This article outlines how adversaries can exploit default or unmanaged IPv6 settings to conduct MITM attacks against Active Directory—intercepting NTLM authentication via tools like mitm6 and ntlmrelayx to potentially create domain accounts—and provides mitigations including disabling unused IPv6 and WPAD, enforcing LDAP and SMB signing, and leveraging a configuration policy to disable IPv6 across the environment.