Sub-technique of T1557 Adversary-in-the-Middle.View on attack.mitre.org
By responding to LLMNR/NBT-NS/mDNS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. This activity may be used to collect or relay authentication materials.
Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts. NBT-NS identifies systems on a local network by their NetBIOS name.
Multicast Domain Name System(mDNS) is a zero-configuration service used to resolve hostnames to IP addresses with “.local” as a top-level domain. MDNS is based upon Domain Name System (DNS) format and allows hosts on the same network segment to perform name resolution for other hosts, using multicast.
Adversaries can spoof an authoritative source for name resolution on a victim network by responding to LLMNR (UDP 5355)/NBT-NS (UDP 137)/mDNS (UDP 5353) traffic as if they know the identity of the requested host, effectively poisoning the service so that the victims will communicate with the adversary controlled system. If the requested host belongs to a resource that requires identification/authentication, the username and NTLMv2 hash will then be sent to the adversary controlled system. The adversary can then collect the hash information sent over the wire through tools that monitor the ports for traffic or through Network Sniffing and crack the hashes offline through Brute Force to obtain the plaintext passwords.
In some cases where an adversary has access to a system that is in the authentication path between systems or when automated scans that use credentials attempt to authenticate to an adversary controlled system, the NTLMv1/v2 hashes can be intercepted and relayed to access and execute code against a target system. The relay step can happen in conjunction with poisoning but may also be independent of it. Additionally, adversaries may encapsulate the NTLMv1/v2 hashes into various other protocols, such as LDAP, MSSQL and HTTP, to expand and use multiple services with the valid NTLM response.
Several tools may be used to poison name services within local networks such as NBNSpoof, Metasploit, and Responder.
Rules on DetectionCode tagged with T1557.001.
| Rule | Level | Log source |
|---|---|---|
| Potential SMB Relay Attack Tool Execution | critical | windows / process_creation |
| Attempts of Kerberos Coercion Via DNS SPN Spoofing | high | windows / process_creation |
| HackTool - ADCSPwn Execution | high | windows / process_creation |
| HackTool - Impacket Tools Execution | high | windows / process_creation |
| Local Privilege Escalation Indicator TabTip | high | windows / NULL |
| RottenPotato Like Attack Pattern | high | windows / NULL |
| Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing | high | windows / dns_query |
| Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network | high | zeek / NULL |
| WinDivert Driver Load | high | windows / driver_load |
| Potential PetitPotam Attack Via EFS RPC Calls | medium | zeek / NULL |
| Rule | Type | Risk | Data source |
|---|---|---|---|
| DNS Kerberos Coercion | TTP | NULL | Suricata, Sysmon EventID 22 |
| Windows Credential Target Information Structure in Commandline | TTP | NULL | Sysmon EventID 1 |
| Windows Kerberos Coercion via DNS | TTP | NULL | Windows Event Log Security 4662, Windows Event Log Security 5136, Windows Event Log Security 5137 |
| Windows Short Lived DNS Record | TTP | NULL | Windows Event Log Security 5136, Windows Event Log Security 5137 |
| Windows Theme File Creation in Unusual Location | Anomaly | NULL | Sysmon EventID 11 |
None recorded.
| Used by | Procedure example |
|---|---|
| GroupLazarus Group | Lazarus Group executed Responder using the command |
| GroupWizard Spider | Wizard Spider has used the Invoke-Inveigh PowerShell cmdlets, likely for name service poisoning. |
| Used by | Procedure example |
|---|---|
| ToolEmpire | Empire can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks. |
| ToolImpacket | Impacket modules like ntlmrelayx and smbrelayx can be used in conjunction with Network Sniffing and Name Resolution Poisoning and SMB Relay to gather NetNTLM credentials for Brute Force or relay attacks that can gain code execution. |
| ToolPoshC2 | PoshC2 can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks. |
| ToolPupy | Pupy can sniff plaintext network credentials and use NBNS Spoofing to poison name services. |
| ToolResponder | Responder is used to poison name services to gather hashes and credentials from systems within a local network. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
