You Thought It Was Over? Authentication Coercion Keeps Evolving

This Unit 42 report explains authentication coercion attacks where adversaries abuse Windows RPC interfaces (including rarely used opnums) to force target systems to authenticate to attacker-controlled hosts, enabling theft of NTLM hashes and potential domain compromise; it includes a March 2025 case using the MS-EVEN ElfrOpenBELW function, discusses known tools (e.g., PetitPotam, PrintNightmare), and provides detection, monitoring and hardening recommendations.