T1557.001 Name Resolution Poisoning and SMB Relay
Subtécnica de T1557 Adversary-in-the-Middle
By responding to LLMNR/NBT-NS/mDNS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system.(Citation: BlackCat ransomware) This activity may be used to collect or relay authentication materials. Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- Potential SMB Relay Attack Tool Executioncriticaltest · windows
- HackTool - ADCSPwn Executionhightest · windows
- HackTool - Impacket Tools Executionhightest · windows
- Local Privilege Escalation Indicator TabTiphightest · windows
- RottenPotato Like Attack Patternhightest · windows
- WinDivert Driver Loadhightest · windows
- Attempts of Kerberos Coercion Via DNS SPN Spoofinghighexperimental · windows
- Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofinghighexperimental · windows
- Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Networkhighexperimental · zeek
- Potential PetitPotam Attack Via EFS RPC Callsmediumtest · zeek
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.