When a Windows host cannot resolve a name through DNS, it may ask everyone on the local network instead. Anyone can answer. MITRE ATT&CK technique T1557.001, Name Resolution Poisoning and SMB Relay, covers abusing that behavior. The tactics are credential access and collection, and the platform is Windows.
How attackers use it
MITRE describes three protocols. Link-Local Multicast Name Resolution (LLMNR) is based on the DNS format and lets hosts on the same link resolve each other's names. NetBIOS Name Service (NBT-NS) identifies systems on a local network by NetBIOS name. Multicast DNS (mDNS) is a zero configuration service that resolves hostnames ending in .local using multicast.
An adversary can spoof an authoritative source by answering LLMNR (UDP 5355), NBT-NS (UDP 137) and mDNS (UDP 5353) traffic as if they knew the requested host. Victims then communicate with the adversary controlled system. If the requested resource needs authentication, the username and NTLMv2 hash are sent to the adversary. They can collect the hashes with tools that monitor those ports or through Network Sniffing, and crack them offline through Brute Force to get plaintext passwords.
There is a second path, relay. When an adversary sits in the authentication path between systems, or when automated scans that use credentials try to authenticate to an adversary controlled system, NTLMv1 or v2 hashes can be intercepted and relayed to reach and run code against a target. MITRE notes the relay can happen together with poisoning or independently. Adversaries may also wrap the hashes in other protocols such as LDAP, MSSQL and HTTP to use the valid response against several services.
MITRE names several tools that poison local name services, including NBNSpoof, Metasploit and Responder. They matter to defenders mainly as signatures for detection.
How to detect it
MITRE lists no data sources on this page. These signals follow from the description:
- Unexpected responders. Hosts answering LLMNR, NBT-NS or mDNS queries that are not supposed to, seen in network monitoring on UDP 5355, 137 and 5353.
- Queries for names that do not exist. Typos and stale names are common triggers, so a spike of failed lookups followed by an answer from a workstation is a strong lead.
- Authentication to odd hosts. NTLM logons to a machine that is not a server, or from one source to many targets. Windows events 4624 (logon) and 4648 (explicit credential logon) help.
- Relay patterns. The same account authenticating from one IP address but arriving at a target from another.
- Honeypot names. A lookup for a decoy hostname that no one should request is a clean alert.
How to reduce the risk
MITRE lists four mitigations.
- Disable or remove the features. Turn off LLMNR, mDNS and NetBIOS in local security settings or through Group Policy if you do not need them.
- Network intrusion prevention. Use systems that can identify traffic patterns typical of AiTM activity.
- Network segmentation. Isolate infrastructure that does not need broad access, which limits the reach of poisoning and relay.
- Filter network traffic. Use host based security software to block LLMNR, NetBIOS and mDNS traffic. Enabling SMB signing can stop NTLMv2 relay attacks.
Disabling the three protocols removes the poisoning opportunity. SMB signing addresses relay. Do both, since they cover different halves of the technique.
Check your own environment
Read-only commands for Windows, run in PowerShell:
# Is LLMNR disabled by policy? A value of 0 means disabled.
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" /v EnableMulticast
# NetBIOS over TCP/IP setting per adapter (2 means disabled)
Get-CimInstance Win32_NetworkAdapterConfiguration -Filter "IPEnabled=True" | Select-Object Description, TcpipNetbiosOptions
# SMB signing: is it required for the server and the client?
Get-SmbServerConfiguration | Select-Object RequireSecuritySignature, EnableSecuritySignature
Get-SmbClientConfiguration | Select-Object RequireSecuritySignature, EnableSecuritySignature
Checklist:
- LLMNR and mDNS are disabled by Group Policy on endpoints that do not need them.
- NetBIOS over TCP/IP is disabled where nothing depends on it.
- SMB signing is required on servers, and on clients where compatibility allows.
- Monitoring covers UDP 5355, 137 and 5353 for responses from unexpected hosts.
- Legacy applications that still need these protocols are listed and have an owner.
Quick check
Why does answering a name query yield a password hash?
If the requested resource needs authentication, the victim sends the username and NTLMv2 hash to whoever answered, which here is the adversary controlled system.
Which control stops NTLMv2 relay specifically?
Enabling SMB signing. Disabling LLMNR, mDNS and NetBIOS addresses the poisoning step.
