SonicALERT
Search

Sonicwall Signatures


Go to All Categories list.
Go to All Applications list.

Application: NTLM

NTLMSSP (NT LAN Manager Security Support Provider) is a binary messaging protocol used by the Microsoft Security Support Provider Interface (SSPI) to facilitate NTLM challenge-response authentication and to negotiate integrity and confidentiality options. NTLMSSP is used wherever SSPI authentication is used including, but not limited to, Server Message Block/CIFS extended security authentication, HTTP Negotiate authentication (e.g. IIS with IWA turned on) and MSRPC services.The Windows Service offering the acceptor side of NTLMSSP has been removed from Windows Vista and Windows Server 2008 in favor of the newer Kerberos authentication protocol.

  NTLM -- NTLM over SMB NEGOTIATE_MESSAGE (Inbound)
  NTLM -- NTLM over SMB NEGOTIATE_MESSAGE (Outbound)
  NTLM -- NTLM over SMB NEGOTIATE_MESSAGE (Outbound) 2
  NTLM -- NTLM over SMB NEGOTIATE_MESSAGE (Inbound) 2


Relevant Information