T1557.001Credential AccessCollection
Name Resolution Poisoning and SMB Relay
By responding to LLMNR/NBT-NS/mDNS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. This activity may be used to collect or relay authentication materials. Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
10 Sigma rules tagged T1557.001Name Resolution Poisoning and SMB RelayT1557.00110 general rules
- Potential SMB Relay Attack Tool Executioncriticaltest
- HackTool - ADCSPwn Executionhightest
- HackTool - Impacket Tools Executionhightest
- Local Privilege Escalation Indicator TabTiphightest
- RottenPotato Like Attack Patternhightest
- WinDivert Driver Loadhightest
- Attempts of Kerberos Coercion Via DNS SPN Spoofinghighexperimental
- Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofinghighexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Name Resolution Poisoning and SMB Relay
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.