Awesome
ProxyRelay
1. Realy ntlm to powershell
Relay ntlm to autodiscover frontend, which then proxies connection to the powershell backend. Or replay ntlm directly to the powershell backend.
https://blog.orange.tw/2022/10/proxyrelay-a-new-attack-surface-on-ms-exchange-part-4.html