LLMNR / NBT-NS / mDNS poisoning

Answering broadcast name lookups tricks hosts into leaking NTLM hashes

categoryNetwork and infrastructure attacksseverityHighdetectabilityHighlabnot yet measured

Example: Responder

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1557.001 · LLMNR Poisoning with Inveigh (PowerShell) · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1557.001 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1557.001 -TestGuids deecd55f-afe0-4a62-9fba-4d1ba2deb321 -TimeoutSeconds 120'

Queued for lab measurement — not yet detonated.

Classification

24 values: 13 reviewed, 9 imported, 2 derived. What do these mean?

Exploitability

Attack vector	Credential attacksNetwork attacks
Reach (CVSS)	Adjacent
Attack complexity	Low
Privileges required	None
User interaction	None
Attacker skill required	Low
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	High
Impact	Confidentiality
Platform	Windows
Environment	On-premises
Target asset class	IdentityNetwork device
Kill-chain phase (tactic)	CollectionCredential Access

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Network Traffic ContentNetwork Traffic FlowService CreationWindows Registry Key Modification

Detection & response

Mitigated by 14

M1030 attack-mitigation
M1031 attack-mitigation
M1037 attack-mitigation
M1042 attack-mitigation
D3-APCA d3fend
D3-CAA d3fend
D3-CSPP d3fend
D3-NTCD d3fend
D3-NTF d3fend
D3-NTSA d3fend
D3-PHDURA d3fend
D3-PMAD d3fend
D3-RTSD d3fend
D3-UGLPA d3fend

Detected by 11

DET0462 attack-detection-strategy
0ed99dda-6a35-11ef-8c99-0242ac120002 sigma
16f5d8ca-44bd-47c8-acbe-6fc95a16c12f sigma
4096842a-8f9f-4d36-92b4-d0b2a62f9b2a sigma
4627c6ae-6899-46e2-aa0c-6ebcb1becd19 sigma
5588576c-5898-4fac-bcdd-7475a60e8f43 sigma
5589ab4f-a767-433c-961d-c91f3f704db1 sigma
679085d5-f427-4484-9f58-1dc30a7c426d sigma
bc2e25ed-b92b-4daa-b074-b502bdd1982b sigma
cd8c163e-a19b-402e-bdd5-419ff5859f12 sigma
e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c sigma

Tested by 1

deecd55f-afe0-4a62-9fba-4d1ba2deb321 atomic

Attack relationships

Parent: AD CS relay (ESC8/ESC11)
Parent: Adversary-in-the-middle (AitM/MITM)
Parent: Adversary-in-the-middle phishing kits
Parent: IPv6 rogue router advertisement
Parent: MITM on key exchange
Parent: Passkey / FIDO downgrade
Parent: Pharming
Parent: Phishing-as-a-service (PhaaS)
Parent: SSL stripping
Parent: STP manipulation

Framework references

Primary source: https://attack.mitre.org/techniques/T1557/001/
attack: T1557.001 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Network and infrastructure attacks' table, line 195 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 7 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)