BED-5037 CoerceNTLMToSMB - Exploitation Information (#1065)

* BED-5037/BED-5100 CoerceNTLMToSMB added exploitation information

packages/javascript/bh-shared-ui/src/components/HelpTexts/CoerceAndRelayNTLMToSMB/Abuse.tsx

@@ -0,0 +1,30 @@
+// Copyright 2025 Specter Ops, Inc.
+//
+// Licensed under the Apache License, Version 2.0
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// SPDX-License-Identifier: Apache-2.0
+
+import { FC } from 'react';
+import { Typography } from '@mui/material';
+
+const Abuse: FC = () => {
+    return (
+        <Typography variant='body2'>
+            An attacker who is a member of "Authenticated Users" triggers a traditional SMB based coercion from the
+            target computer to their attacker host. The attacker relays this authentication attempt to the target system
+            the inbound account has admin access to.
+        </Typography>
+    );
+};
+
+export default Abuse;

packages/javascript/bh-shared-ui/src/components/HelpTexts/CoerceAndRelayNTLMToSMB/CoerceAndRelayNTLMToSMB.tsx

@@ -0,0 +1,23 @@
+// Copyright 2025 Specter Ops, Inc.
+//
+// Licensed under the Apache License, Version 2.0
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// SPDX-License-Identifier: Apache-2.0
+
+import Abuse from './Abuse';
+
+const CoerceAndRelayNTLMToSMB = {
+    abuse: Abuse,
+};
+
+export default CoerceAndRelayNTLMToSMB;

packages/javascript/bh-shared-ui/src/components/HelpTexts/index.tsx

@@ -121,6 +121,7 @@ import ADCSESC9b from './ADCSESC9b/ADCSESC9b';
 import ADCSESC10a from './ADCSESC10a/ADCSESC10a';
 import ADCSESC10b from './ADCSESC10b/ADCSESC10b';
 import ADCSESC13 from './ADCSESC13/ADCSESC13';
+import CoerceAndRelayNTLMToSMB from './CoerceAndRelayNTLMToSMB/CoerceAndRelayNTLMToSMB';
 
 export type EdgeInfoProps = {
     edgeName?: string;
@@ -240,6 +241,7 @@ const EdgeInfoComponents = {
     ExtendedByPolicy: ExtendedByPolicy,
     SyncedToADUser: SyncedToADUser,
     SyncedToEntraUser: SyncedToEntraUser,
+    CoerceAndRelayNTLMToSMB: CoerceAndRelayNTLMToSMB,
 };
 
 export default EdgeInfoComponents;

packages/javascript/bh-shared-ui/src/views/Explore/ExploreSearch/edgeTypes.tsx

@@ -115,6 +115,10 @@ export const AllEdgeTypes: Category[] = [
                 name: 'Cross Platform',
                 edgeTypes: [ActiveDirectoryRelationshipKind.SyncedToEntraUser],
             },
+            {
+                name: 'NTLM Relay',
+                edgeTypes: [ActiveDirectoryRelationshipKind.CoerceAndRelayNTLMToSMB],
+            },
         ],
     },
     {