Wizard SpiderG0102 ↗
Has used the Invoke-Inveigh PowerShell cmdlets, likely for name service poisoning.1
tfMITRE ATT&CK sub-technique
Name Resolution Poisoning and SMB Relay T1557.001
sub-technique of T1557 Adversary-in-the-Middle
- Tactics
- Credential Access, Collection
- Platform
- Windows
- Version
- 2.0
- Created
- 11 February 2020
- Last modified
- 12 May 2026
- Contributors
- Eric Kuehn, Secure Ideas; Matthew Demaske, Adaptforward; Andrew Allen, @whitehat_zero; Arad Inbar
By responding to LLMNR/NBT-NS/mDNS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system.[1] This activity may be used to collect or relay authentication materials.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.5
Tools & malware66th pct
Tools & malware66th percentile · 66% of ATT&CK techniques have this many tools implementing them or fewer.15
Detection rulesTop 16%
Detection rules84th percentile · 84% of ATT&CK techniques have this many detection rules written or fewer.Name Resolution Poisoning and SMB Relay MITRE reference T1557.001
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Lazarus GroupG0032 ↗
Executed Responder using the command [Responder file path] -i [IP address] -rPv on a compromised host to harvest credentials and move laterally.1
All 2 groups for this technique
5 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
PoshC2S0378 ↗
Can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.1
EmpireS0363 ↗
Can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.12
ImpacketS0357 ↗
Modules like ntlmrelayx and smbrelayx can be used in conjunction with Network Sniffing and Name Resolution Poisoning and SMB Relay to gather NetNTLM credentials for Brute Force or relay attacks that can gain code execution.1
PupyS0192 ↗
Can sniff plaintext network credentials and use NBNS Spoofing to poison name services.1
ResponderS0174 ↗
Is used to poison name services to gather hashes and credentials from systems within a local network.1
All 5 software entries for this technique
Offense vs defense T1557.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 10Splunk ESCU (cumulative) · 5
first rule: 2019 Q4Name Resolution Poisoning and SMB Relay detection strategy DET0462
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect LLMNR/NBT-NS Poisoning and SMB Relay on Windows
1 platform
AN1274 · Windows
Detects anomalous network traffic on UDP 5355 (LLMNR) and UDP 137 (NBT-NS) combined with unauthorized SMB relay attempts, registry modifications re-enabling multicast name resolution, or suspicious service creation indicative of adversary-in-the-middle credential interception.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Service CreationDC0060 | WinEventLog:Security | EventCode=4697 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Security | Registry key modification HKLM\Software\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast |
| Network Traffic FlowDC0078 | NSM:Flow | Abnormal SMB authentication attempts correlated with poisoned LLMNR/NBT-NS sessions |
| Network Traffic ContentDC0085 | NSM:Flow | Unusual responses to LLMNR (UDP 5355) or NBT-NS (UDP 137) queries from unauthorized hosts |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TrustedResponderList | Defines expected LLMNR/NBT-NS responders to tune out legitimate services. |
| TimeWindow | Correlation period for linking poisoned name resolution with SMB relay attempts. |
| SMBServiceBaseline | Normal services and SMB relay patterns in the enterprise environment. |
Disable LLMNR, mDNS, and NetBIOS in local computer security settings or by group policy if they are not needed within an environment.
Use host-based security software to block LLMNR/NetBIOS/mDNS traffic. Enabling SMB Signing can stop NTLMv2 relay attacks.
Network intrusion detection and prevention systems that can identify traffic patterns indicative of AiTM activity can be used to mitigate activity at the network level.
Network SegmentationM1030
Network segmentation can be used to isolate infrastructure components that do not require broad network access. This may mitigate, or at least alleviate, the scope of AiTM activity.
Tests1ExecutorsPowerShell 1Need elevation1 of 1Have prerequisites0Have cleanup0Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition