You Thought It Was Over? Authentication Coercion Keeps Evolving

Authentication coercion is described as forcing a computer to authenticate to an attacker‑controlled system, enabling attackers to steal credentials without tricking users into revealing passwords. The piece highlights a real‑world March 2025 incident in a healthcare network where a machine used a rare MS‑EVEN RPC interface (ElfrOpenBELW) to coerce authentication and then attempted NTLM relays to multiple critical servers, leading to credential theft and lateral movement.

It notes that while PrintNightmare (CVE‑2021‑34527) brought attention to coercion techniques, threat actors are increasingly exploiting rare RPC functions to avoid detection, and that a Windows Coerced Authentication Methods repository lists many additional opnums yet untested.

The article cites a May 2022 CISA report about a Russian state‑sponsored group exploiting PrintNightmare to access cloud and email accounts, and points to publicly available PoCs and tools such as PetitPotam to illustrate practical attack methods. It concludes with actionable guidance on monitoring and hardening RPC traffic, including filtering, SMB signing enforcement, EPA, and disabling unused RPC services, and stresses the need for context‑aware RPC monitoring beyond known tools, according to Unit 42.