T1557.001 Name Resolution Poisoning and SMB Relay
Sub-technique of T1557 Adversary-in-the-Middle
By responding to LLMNR/NBT-NS/mDNS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system.(Citation: BlackCat ransomware) This activity may be used to collect or relay authentication materials. Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Potential SMB Relay Attack Tool Executioncriticaltest · windows
- HackTool - ADCSPwn Executionhightest · windows
- HackTool - Impacket Tools Executionhightest · windows
- Local Privilege Escalation Indicator TabTiphightest · windows
- RottenPotato Like Attack Patternhightest · windows
- WinDivert Driver Loadhightest · windows
- Attempts of Kerberos Coercion Via DNS SPN Spoofinghighexperimental · windows
- Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofinghighexperimental · windows
- Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Networkhighexperimental · zeek
- Potential PetitPotam Attack Via EFS RPC Callsmediumtest · zeek
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.