T1557.001: LLMNR/NBT-NS Poisoning and SMB Relay
By responding to LLMNR/NBT-NS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. This activity may be used to collect or relay authentication materials.
Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts. NBT-NS identifies systems on a local network by their NetBIOS name.
Adversaries can spoof an authoritative source for name resolution on a victim network by responding to LLMNR (UDP 5355)/NBT-NS (UDP 137) traffic as if they know the identity of the requested host, effectively poisoning the service so that the victims will communicate with the adversary controlled system. If the requested host belongs to a resource that requires identification/authentication, the username and NTLMv2 hash will then be sent to the adversary controlled system. The adversary can then collect the hash information sent over the wire through tools that monitor the ports for traffic or through Network Sniffing and crack the hashes offline through Brute Force to obtain the plaintext passwords.
In some cases where an adversary has access to a system that is in the authentication path between systems or when automated scans that use credentials attempt to authenticate to an adversary controlled system, the NTLMv1/v2 hashes can be intercepted and relayed to access and execute code against a target system. The relay step can happen in conjunction with poisoning but may also be independent of it. Additionally, adversaries may encapsulate the NTLMv1/v2 hashes into various protocols, such as LDAP, SMB, MSSQL and HTTP, to expand and use multiple services with the valid NTLM response.
Several tools may be used to poison name services within local networks such as NBNSpoof, Metasploit, and Responder.
Positive Technologies products that cover the technique
MaxPatrol SIEM knowledge base
mitre_attck_lateral_movement: PT-CR-2768: MSSQL_NTLM_Relay: Possible NTLM Relay attack using an MS SQL client. With access to a low-privileged account, attackers can carry out an NTLM Relay attack by connecting to an MS SQL client and executing stored procedures with the UNC path to the attacker's host specified in the parameters. mitre_attck_lateral_movement: PT-CR-786: NTLM_Relay_Auth: A possible NTLM relay attack is detected mitre_attck_lateral_movement: PT-CR-2766: Subrule_MSSQL_NTLM_Relay: A stored procedure was executed from a remote MS SQL client vulnerabilities: PT-CR-2659: CVE_2024_38200_Office_NTLM_Relay: Exploitation of vulnerability CVE-2024-38200 in Microsoft Office. This may indicate an NTLM relay attack after a user opens a specially crafted document via a link sent by an attacker and performs NTLM authentication. vulnerabilities: PT-CR-2948: Subrule_CVE_2025_24071_NTLM_Hash_Leak: An archiver process or Windows Explorer created a file with the .library-ms extension vulnerabilities: PT-CR-2949: CVE_2025_24071_NTLM_Hash_Leak: Possible exploitation of the CVE-2025-24071 vulnerability in Windows Explorer. A file with the .library-ms extension was extracted from an archive, which can result in the user's password hash being transferred to the attacker's server. active_directory_certificate_services_attacks: PT-CR-2641: Cert_Compromise_Via_NTLM_Relay: The ESC8 or ESC11 technique was used. As a result of an NTLM Relay attack on a CA, a certificate was obtained in the name of the target account. Using this certificate, attackers can act at the victim's privilege level. active_directory_certificate_services_attacks: PT-CR-2642: Subrule_Hostname_Mismatch: Mismatch of source hostname for the same IP address during network connection and login. This may indicate an NTLM Relay attack. microsoft_mecm: PT-CR-1865: MECM_NTLM_Relay_Via_SharpSCCM: Forcefully installing the MECM client using SharpSCCM to redirect NTLM authentication mitre_attck_privilege_escalation: PT-CR-852: Remote_Potato_Relay_Hash: The NTLM hash of a logged on user is captured using the RemotePotato technique mitre_attck_privilege_escalation: PT-CR-851: Remote_Potato_Capture_Hash: The user's NTLM hash is captured using the RemotePotato technique
Detection
| ID | DS0029 | Data source and component | Network Traffic: Network Traffic Content | Description | Monitor for traffic on ports UDP 5355 and UDP 137 if LLMNR/NetBIOS is disabled by security policy. |
|---|
| ID | DS0029 | Data source and component | Network Traffic: Network Traffic Flow | Description | Monitor for network traffic originating from unknown/unexpected hardware devices. Local network traffic metadata (such as source MAC addressing) as well as usage of network management protocols such as DHCP may be helpful in identifying hardware. |
|---|
| ID | DS0024 | Data source and component | Windows Registry: Windows Registry Key Modification | Description | Monitor HKLM\Software\Policies\Microsoft\Windows NT\DNSClient for changes to the "EnableMulticast" DWORD value. A value of "0" indicates LLMNR is disabled. |
|---|
| ID | DS0019 | Data source and component | Service: Service Creation | Description | Monitor for newly constructed services/daemons through Windows event logs for event IDs 4697 and 7045. Deploy an LLMNR/NBT-NS spoofing detection tool. |
|---|
Mitigation
| ID | M1042 | Name | Disable or Remove Feature or Program | Description | Disable LLMNR and NetBIOS in local computer security settings or by group policy if they are not needed within an environment. |
|---|
| ID | M1031 | Name | Network Intrusion Prevention | Description | Network intrusion detection and prevention systems that can identify traffic patterns indicative of AiTM activity can be used to mitigate activity at the network level. |
|---|
| ID | M1030 | Name | Network Segmentation | Description | Network segmentation can be used to isolate infrastructure components that do not require broad network access. This may mitigate, or at least alleviate, the scope of AiTM activity. |
|---|
| ID | M1037 | Name | Filter Network Traffic | Description | Use host-based security software to block LLMNR/NetBIOS traffic. Enabling SMB Signing can stop NTLMv2 relay attacks. |
|---|