SMB authentication coercion is a tactic that tricks a system into initiating an outbound SMB connection, often to an attacker-controlled host. When the target tries to authenticate, it may send NTLM credentials or other authentication material that can sometimes be relayed, captured, or abused. The attacker does not usually need a password; the goal is to make the victim “call out” first.
This matters because many Windows environments still rely on SMB for file sharing, management, and printer or service interactions. If a privileged service account can be coerced, the resulting authentication may be useful for relay attacks, privilege escalation, or lateral movement. Defenders reduce the risk by disabling unnecessary SMB exposure, restricting outbound network paths, hardening service accounts, and monitoring for unexpected SMB connections to untrusted hosts. In incident response, unusual outbound SMB traffic is often a strong clue that coercion or relay activity is underway.