ProxyRelay

1. Realy ntlm to powershell

Relay ntlm to autodiscover frontend, which then proxies connection to the powershell backend. Or replay ntlm directly to the powershell backend.

https://blog.orange.tw/2022/10/proxyrelay-a-new-attack-surface-on-ms-exchange-part-4.html