DFSCoerce

Tool

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

January 15, 2026

Last Seen

January 30, 2026

API

DFSCoerce is described in connection with efforts to deprecate Net-NTLMv1 by releasing rainbow tables that accelerate offline cracking of Net-NTLMv1 hashes.

Overview

Recent Events

Relationships

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Related Clusters (2)

Mandiant Releases Tools to Combat Net-NTLMv1 Protocol Vulnerabilities

Jan 19·4 sources

Microsoft to Disable NTLM by Default in Future Windows Releases

Jan 30·10 sources

Related Entities

Brute Force Man-in-the-Middle NTLM Relay Pass The Hash T1003.006 - DCSync Windows Active Directory Certificate Services Windows Server PetitPotam Gsutil Hashcat Impacket

DFSCoerce

Overview

Recent Events

Profile

Attack Types

MITRE Techniques

Platforms

Relationships

Related Clusters (2)

Mandiant Releases Tools to Combat Net-NTLMv1 Protocol Vulnerabilities

Microsoft to Disable NTLM by Default in Future Windows Releases

Related Articles (2)

Microsoft to disable NTLM by default in future Windows releases

Closing the Door on Net-NTLMv1: Releasing Rainbow Tables to Accelerate Protocol Deprecation

Related Entities