ProxyRelay 1. Realy ntlm to powershell Relay ntlm to autodiscover frontend, which then proxies connection to the powershell backend. Or replay ntlm directly to the powershell backend. https://blog.orange.tw/2022/10/proxyrelay-a-new-attack-surface-on-ms-exchange-part-4.html