Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1557.001: Name Resolution Poisoning and SMB Relay

By responding to LLMNR/NBT-NS/mDNS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system.[1] This activity may be used to collect or relay authentication materials.

Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts. NBT-NS identifies systems on a local network by their NetBIOS name.[2][3]

Multicast Domain Name System(mDNS) is a zero-configuration service used to resolve hostnames to IP addresses with “.local” as a top-level domain. MDNS is based upon Domain Name System (DNS) format and allows hosts on the same network segment to perform name resolution for other hosts, using multicast.[4]

Adversaries can spoof an authoritative source for name resolution on a victim network by responding to LLMNR (UDP 5355)/NBT-NS (UDP 137)/mDNS (UDP 5353) traffic as if they know the identity of the requested host, effectively poisoning the service so that the victims will communicate with the adversary controlled system. If the requested host belongs to a resource that requires identification/authentication, the username and NTLMv2 hash will then be sent to the adversary controlled system. The adversary can then collect the hash information sent over the wire through tools that monitor the ports for traffic or through Network Sniffing and crack the hashes offline through Brute Force to obtain the plaintext passwords.

In some cases where an adversary has access to a system that is in the authentication path between systems or when automated scans that use credentials attempt to authenticate to an adversary controlled system, the NTLMv1/v2 hashes can be intercepted and relayed to access and execute code against a target system. The relay step can happen in conjunction with poisoning but may also be independent of it.[5][6] Additionally, adversaries may encapsulate the NTLMv1/v2 hashes into various other protocols, such as LDAP, MSSQL and HTTP, to expand and use multiple services with the valid NTLM response.

Several tools may be used to poison name services within local networks such as NBNSpoof, Metasploit, and Responder.[7][8][9]

EnterpriseT1557.001Sub-techniqueObject v2.0 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Name Resolution Poisoning and SMB Relay matters because it can turn routine Windows name-resolution fallback traffic into credential exposure or relay opportunities. If Windows systems still rely on LLMNR, NBT-NS, or mDNS on local segments, an attacker-positioned system may impersonate a requested host and cause victims or automated credentialed processes to authenticate to it. For leaders, the risk is not just “hash theft”; it is whether local network design, legacy name-resolution behavior, and NTLM-dependent workflows create a practical path from one foothold to broader access.

Executive priority

Prioritize this where Windows endpoints, shared network segments, NTLM authentication, and internal scanning or administration workflows intersect. The business decision is whether legacy convenience protocols are worth the credential-access and collection risk they introduce. Ask for evidence that unnecessary name-resolution features are disabled where feasible, lateral traffic is segmented and filtered, and SOC teams can see suspicious LLMNR/NBT-NS/mDNS responses and NTLM relay patterns. This also supports audit and resilience conversations because it tests whether identity controls and network architecture reduce post-compromise movement rather than only protecting the perimeter.

Technical view

ATT&CK defines this as a Windows sub-technique of Adversary-in-the-Middle under credential-access and collection. Defenders should validate exposure on UDP 5355 for LLMNR, UDP 137 for NBT-NS, and UDP 5353 for mDNS, then test whether hosts can be induced to send NTLMv1/v2 material to unexpected systems. Because official detection text is not provided, detection engineering should rely on relationship context, especially DET0462, network telemetry, and authentication evidence. Pay special attention to relays into SMB and possible encapsulation into LDAP, MSSQL, or HTTP as described by ATT&CK. Tool context includes Responder, Impacket, Empire, PoshC2, Pupy, NBNSpoof, and Metasploit-related capability references; treat these as analytic pivots, not proof of activity by themselves.

Likely telemetry

  • Network traffic for LLMNR on UDP 5355, NBT-NS on UDP 137, and mDNS on UDP 5353
  • Responses to name-resolution requests from unexpected or non-authoritative hosts on the same local segment
  • SMB authentication attempts and NTLMv1/v2 challenge-response activity involving unusual internal systems
  • LDAP, MSSQL, HTTP, or SMB connections shortly after name-resolution requests
  • Endpoint firewall, Windows host, and network sensor logs showing lateral traffic patterns

Detection direction

  • Validate DET0462 or equivalent analytics against the actual Windows network segments where multicast or broadcast name resolution is allowed.
  • Alert on hosts that answer many LLMNR/NBT-NS/mDNS queries, especially when they are not expected name-resolution infrastructure.
  • Correlate name-resolution poisoning indicators with subsequent NTLM authentication to the same host or with SMB, LDAP, MSSQL, or HTTP relay-like activity.
  • Tune for legitimate local discovery and zero-configuration services to reduce noise, especially for mDNS, while preserving visibility into unexpected responders.
  • Do not rely only on endpoint process names or known tool signatures; ATT&CK notes the behavior can be performed through multiple tools and protocol paths.

Mitigation priorities

  • First, disable or remove unnecessary name-resolution features or services where business operations allow, aligning to M1042.
  • Segment networks to reduce exposure between workstations, servers, administrative systems, and critical assets, aligning to M1030.
  • Filter lateral network traffic so only required protocols and sources can communicate across segments, aligning to M1037.
  • Use network intrusion prevention or detection signatures at appropriate boundaries to block or alert on suspicious traffic, aligning to M1031.
  • Reduce dependence on NTLM-based workflows where feasible and verify that administrative and scanning processes do not unnecessarily authenticate broadly across local segments.
Analyst notes and limits

This object replaces revoked technique T1171 and is a sub-technique of T1557 Adversary-in-the-Middle. ATT&CK maps use of this behavior to Lazarus Group and Wizard Spider and maps related software including Responder, Pupy, Impacket, Empire, and PoshC2. Those relationships are useful for threat-informed hunting and purple-team planning, but local evidence is required before inferring any specific actor or tool. The strongest defensive value is usually gained by combining configuration review, network segmentation validation, and authentication-path monitoring.

Official ATT&CK detection guidance for this object is not provided in the supplied fields. The take is therefore based on the official description, listed protocols and ports, platform and tactic metadata, external references, and supplied relationships. It does not assert active exploitation, customer exposure, or guaranteed detection coverage.

Official MITRE ATT&CK definition

Name Resolution Poisoning and SMB Relay

By responding to LLMNR/NBT-NS/mDNS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system.[1] This activity may be used to collect or relay authentication materials.

Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts. NBT-NS identifies systems on a local network by their NetBIOS name.[2][3]

Multicast Domain Name System(mDNS) is a zero-configuration service used to resolve hostnames to IP addresses with “.local” as a top-level domain. MDNS is based upon Domain Name System (DNS) format and allows hosts on the same network segment to perform name resolution for other hosts, using multicast.[4]

Adversaries can spoof an authoritative source for name resolution on a victim network by responding to LLMNR (UDP 5355)/NBT-NS (UDP 137)/mDNS (UDP 5353) traffic as if they know the identity of the requested host, effectively poisoning the service so that the victims will communicate with the adversary controlled system. If the requested host belongs to a resource that requires identification/authentication, the username and NTLMv2 hash will then be sent to the adversary controlled system. The adversary can then collect the hash information sent over the wire through tools that monitor the ports for traffic or through Network Sniffing and crack the hashes offline through Brute Force to obtain the plaintext passwords.

In some cases where an adversary has access to a system that is in the authentication path between systems or when automated scans that use credentials attempt to authenticate to an adversary controlled system, the NTLMv1/v2 hashes can be intercepted and relayed to access and execute code against a target system. The relay step can happen in conjunction with poisoning but may also be independent of it.[5][6] Additionally, adversaries may encapsulate the NTLMv1/v2 hashes into various other protocols, such as LDAP, MSSQL and HTTP, to expand and use multiple services with the valid NTLM response.

Several tools may be used to poison name services within local networks such as NBNSpoof, Metasploit, and Responder.[7][8][9]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

2 rows
Domain ID Name Relationship / procedure
Enterprise T1557 Adversary-in-the-Middle This object subtechnique of Adversary-in-the-Middle.
Enterprise T1171 LLMNR/NBT-NS Poisoning and Relay LLMNR/NBT-NS Poisoning and Relay revoked by this object.
Associated objects

Groups, software, and campaigns

Group Enterprise

G0032: Lazarus Group

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]

North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]

Group Enterprise

G0102: Wizard Spider

Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.[1][2][3]

Tool Enterprise

S0357: Impacket

Impacket is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols. Impacket contains several tools for remote service execution, Kerberos manipulation, Windows credential dumping, packet sniffing, and relay attacks.[1]

LinuxmacOSWindows
Tool Enterprise

S0363: Empire

Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS. Empire was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.[1][2][3]

LinuxmacOSWindows
Tool Enterprise

S0378: PoshC2

PoshC2 is an open source remote administration and post-exploitation framework that is publicly available on GitHub. The server-side components of the tool are primarily written in Python, while the implants are written in PowerShell. Although PoshC2 is primarily focused on Windows implantation, it does contain a basic Python dropper for Linux/macOS.[1]

WindowsLinuxmacOS
Tool Enterprise

S0192: Pupy

Pupy is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. [1] It is written in Python and can be generated as a payload in several different ways (Windows exe, Python file, PowerShell oneliner/file, Linux elf, APK, Rubber Ducky, etc.). [1] Pupy is publicly available on GitHub. [1]

LinuxWindowsmacOS
Tool Enterprise

S0174: Responder

Responder is an open source tool used for LLMNR, NBT-NS and MDNS poisoning, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication. [1]

Relationship explorer

All related ATT&CK context

uses · Tool S0357: Impacket Enterprise uses · Tool S0363: Empire Enterprise uses · Tool S0378: PoshC2 Enterprise mitigates · Mitigation M1042: Disable or Remove Feature or Program Enterprise subtechnique of · Technique T1557: Adversary-in-the-Middle Enterprise uses · Group G0032: Lazarus Group Enterprise mitigates · Mitigation M1031: Network Intrusion Prevention Enterprise revoked by · Technique T1171: LLMNR/NBT-NS Poisoning and Relay Enterprise uses · Group G0102: Wizard Spider Enterprise detects · Detection Strategy DET0462: Detect LLMNR/NBT-NS Poisoning and SMB Relay on Windows Enterprise uses · Tool S0192: Pupy Enterprise uses · Tool S0174: Responder Enterprise mitigates · Mitigation M1030: Network Segmentation Enterprise mitigates · Mitigation M1037: Filter Network Traffic Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1042: Disable or Remove Feature or Program

Disable or remove unnecessary and potentially vulnerable software, features, or services to reduce the attack surface and prevent abuse by adversaries. This involves identifying software or features that are no longer needed or that could be exploited and ensuring they are either removed or properly disabled. This mitigation can be implemented through the following measures:

Remove Legacy Software:

- Use Case: Disable or remove older versions of software that no longer receive updates or security patches (e.g., legacy Java, Adobe Flash). - Implementation: A company removes Flash Player from all employee systems after it has reached its end-of-life date.

Disable Unused Features:

- Use Case: Turn off unnecessary operating system features like SMBv1, Telnet, or RDP if they are not required. - Implementation: Disable SMBv1 in a Windows environment to mitigate vulnerabilities like EternalBlue.

Control Applications Installed by Users:

- Use Case: Prevent users from installing unauthorized software via group policies or other management tools. - Implementation: Block user installations of unauthorized file-sharing applications (e.g., BitTorrent clients) in an enterprise environment.

Remove Unnecessary Services:

- Use Case: Identify and disable unnecessary default services running on endpoints, servers, or network devices. - Implementation: Disable unused administrative shares (e.g., C$, ADMIN$) on workstations.

Restrict Add-ons and Plugins:

- Use Case: Remove or disable browser plugins and add-ons that are not needed for business purposes. - Implementation: Disable Java and ActiveX plugins in web browsers to prevent drive-by attacks.

Mitigation Enterprise

M1030: Network Segmentation

Network segmentation involves dividing a network into smaller, isolated segments to control and limit the flow of traffic between devices, systems, and applications. By segmenting networks, organizations can reduce the attack surface, restrict lateral movement by adversaries, and protect critical assets from compromise.

Effective network segmentation leverages a combination of physical boundaries, logical separation through VLANs, and access control policies enforced by network appliances like firewalls, routers, and cloud-based configurations. This mitigation can be implemented through the following measures:

Segment Critical Systems:

- Identify and group systems based on their function, sensitivity, and risk. Examples include payment systems, HR databases, production systems, and internet-facing servers. - Use VLANs, firewalls, or routers to enforce logical separation.

Implement DMZ for Public-Facing Services:

- Host web servers, DNS servers, and email servers in a DMZ to limit their access to internal systems. - Apply strict firewall rules to filter traffic between the DMZ and internal networks.

Use Cloud-Based Segmentation:

- In cloud environments, use VPCs, subnets, and security groups to isolate applications and enforce traffic rules. - Apply AWS Transit Gateway or Azure VNet peering for controlled connectivity between cloud segments.

Apply Microsegmentation for Workloads:

- Use software-defined networking (SDN) tools to implement workload-level segmentation and prevent lateral movement.

Restrict Traffic with ACLs and Firewalls:

- Apply Access Control Lists (ACLs) to network devices to enforce "deny by default" policies. - Use firewalls to restrict both north-south (external-internal) and east-west (internal-internal) traffic.

Monitor and Audit Segmented Networks:

- Regularly review firewall rules, ACLs, and segmentation policies. - Monitor network flows for anomalies to ensure segmentation is effective.

Test Segmentation Effectiveness:

- Perform periodic penetration tests to verify that unauthorized access is blocked between network segments.

Mitigation Enterprise

M1037: Filter Network Traffic

Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures:

Ingress Traffic Filtering:

- Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers. - Implementation: Limit SSH (port 22) and RDP (port 3389) traffic to specific IP ranges.

Egress Traffic Filtering:

- Use Case: Use firewalls or endpoint security software to block unauthorized outbound traffic to prevent data exfiltration and command-and-control (C2) communications. - Implementation: Block outbound traffic to known malicious IPs or regions where communication is unexpected.

Protocol-Based Filtering:

- Use Case: Restrict the use of specific protocols that are commonly abused by adversaries, such as SMB, RPC, or Telnet, based on business needs. - Implementation: Disable SMBv1 on endpoints to prevent exploits like EternalBlue.

Network Segmentation:

- Use Case: Create network segments for critical systems and restrict communication between segments unless explicitly authorized. - Implementation: Implement VLANs to isolate IoT devices or guest networks from core business systems.

Application Layer Filtering:

- Use Case: Use proxy servers or Web Application Firewalls (WAFs) to inspect and block malicious HTTP/S traffic. - Implementation: Configure a WAF to block SQL injection attempts or other web application exploitation techniques.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
8a613ee666ffd499...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 2.0 Current bundle 8a613ee666ff…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    BlackCat ransomware

    Lucas Silva, Leandro Froes. (2022, April 18). An Investigation of the BlackCat Ransomware via Trend Micro Vision One. Retrieved February 2, 2026.

    Open source URL
  2. [2]
    Wikipedia LLMNR

    Wikipedia. (2016, July 7). Link-Local Multicast Name Resolution. Retrieved November 17, 2017.

    Open source URL
  3. [3]
    TechNet NetBIOS

    Microsoft. (n.d.). NetBIOS Name Resolution. Retrieved November 17, 2017.

    Open source URL
  4. [4]
    mDNS RFC

    S. Cheshire, M. Krochmal. (2013, February). Multicast DNS. Retrieved February 2, 2026.

    Open source URL
  5. [5]
    byt3bl33d3r NTLM Relaying

    Salvati, M. (2017, June 2). Practical guide to NTLM Relaying in 2017 (A.K.A getting a foothold in under 5 minutes). Retrieved February 7, 2019.

    Open source URL
  6. [6]
    Secure Ideas SMB Relay

    Kuehn, E. (2018, April 11). Ever Run a Relay? Why SMB Relays Should Be On Your Mind. Retrieved February 7, 2019.

    Open source URL
  7. [7]
    GitHub NBNSpoof

    Nomex. (2014, February 7). NBNSpoof. Retrieved November 17, 2017.

    Open source URL
  8. [8]
    Rapid7 LLMNR Spoofer

    Francois, R. (n.d.). LLMNR Spoofer. Retrieved November 17, 2017.

    Open source URL
  9. [9]
    GitHub Responder

    Gaffie, L. (2016, August 25). Responder. Retrieved November 17, 2017.

    Open source URL
  10. [10]
    mitre-attack T1557.001
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use