Authentication Coercion: How Windows Machines Are Tricked into Leaking Credentials

Authentication coercion is a Windows-focused attack class that exploits native OS features to make machines authenticate to attacker-controlled systems without user interaction or exploits. The technique manipulates legitimate Remote Procedure Call protocols, with threat actors setting up malicious listeners that impersonate resources so targeted hosts transmit hashed credentials.

Researchers note a shift away from well-known exploits toward abusing rarely monitored RPC interfaces and functions, aided by the legitimate MS-EVEN (EventLog Remoting Protocol) usage when connecting to remote servers in the Event Viewer console. According to unit42.paloaltonetworks[.]com, a publicly available repository documents 16 working functions across five protocols for attackers to leverage, and more than 240 additional functions remain untested and potentially exploitable.

In a March 2025 incident affecting a healthcare organization, attackers exploited MS-EVEN to coerce authentication from multiple critical servers, including Domain Controllers and Citrix systems, harvesting NTLM hashes and conducting an NTLM relay attack against certificate authority servers.

Mitigations call for generic RPC monitoring, turning off unused RPC services, SMB signing, Extended Protection for Authentication, and disabling unnecessary services like Print Spooler on Domain Controllers to reduce the attack surface.