Name Resolution Poisoning and SMB Relay
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
DET0462 has a single analytic with a single log source, Security EventID 4697, and none of the behaviour the analytic describes reaches it. AN1274 names three observables — anomalous UDP 5355 (LLMNR) and UDP 137 (NBT-NS) traffic, registry modifications re-enabling multicast name resolution, and service creation — but the brief supplies no network_connection source and no registry source at all, so the poisoning half of the technique, which is the half the technique is named for, has nothing to be written against. 4697 carries ServiceName, ServiceFileName, ServiceType, ServiceStartType and ServiceAccount; not one of those can express a spoofed name-resolution response, a UDP port, or an EnableMulticast value under HKLM\Software\Policies\Microsoft\Windows NT\DNSClient. […]
What the technique is
By responding to LLMNR/NBT-NS/mDNS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. This activity may be used to collect or relay authentication materials. Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts. NBT-NS identifies systems on a local network by their NetBIOS name. Multicast Domain Name System(mDNS) is a zero-configuration service used to resolve hostnames to IP addresses with “.local” as a top-level domain. MDNS is based upon Domain Name System (DNS) format and allows hosts on the same network segment to perform name resolution for other hosts, using multicast. Adversaries can spoof an authoritative source for name resolution on a victim network by responding to LLMNR (UDP 5355)/NBT-NS (UDP 137)/mDNS (UDP 5353) traffic as if they know the identity of the requested host, effectively poisoning the service so that the victims will communicate with the adversary controlled system. […]
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1274
Detects anomalous network traffic on UDP 5355 (LLMNR) and UDP 137 (NBT-NS) combined with unauthorized SMB relay attempts, registry modifications re-enabling multicast name resolution, or suspicious service creation indicative of adversary-in-the-middle credential interception.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.