Name Resolution Poisoning and SMB Relay
Subtechnique · ATTACK:enterprise:T1557.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1557.001",
"title": "Name Resolution Poisoning and SMB Relay",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1557/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--650c784b-7504-4df7-ab2c-4ea882384d1e",
"external_id": "T1557.001",
"domain": "enterprise",
"created": "2020-02-11T19:08:51.677Z",
"modified": "2026-05-12T15:12:00.636Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"credential-access",
"collection"
],
"source_references": [
{
"source_name": "Rapid7 LLMNR Spoofer",
"url": "https://www.rapid7.com/db/modules/auxiliary/spoof/llmnr/llmnr_response"
},
{
"source_name": "GitHub Responder",
"url": "https://github.com/SpiderLabs/Responder"
},
{
"source_name": "Secure Ideas SMB Relay",
"url": "https://blog.secureideas.com/2018/04/ever-run-a-relay-why-smb-relays-should-be-on-your-mind.html"
},
{
"source_name": "BlackCat ransomware",
"url": "https://www.trendmicro.com/en_us/research/22/d/an-investigation-of-the-blackcat-ransomware.html"
},
{
"source_name": "TechNet NetBIOS",
"url": "https://technet.microsoft.com/library/cc958811.aspx"
},
{
"source_name": "GitHub NBNSpoof",
"url": "https://github.com/nomex/nbnspoof"
},
{
"source_name": "mDNS RFC",
"url": "https://datatracker.ietf.org/doc/html/rfc6762"
},
{
"source_name": "byt3bl33d3r NTLM Relaying",
"url": "https://byt3bl33d3r.github.io/practical-guide-to-ntlm-relaying-in-2017-aka-getting-a-foothold-in-under-5-minutes.html"
},
{
"source_name": "Wikipedia LLMNR",
"url": "https://en.wikipedia.org/wiki/Link-Local_Multicast_Name_Resolution"
}
]
}Explicit source assertions (12)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0357 → uses → ATTACK:enterprise:T1557.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0318431e-ad44-44c7-97be-686d4efe79f4
Impacket ToolsATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1557.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0537c342-77af-4626-bbe3-9360798a30d5
Github PowerShell Empire · GitHub InveighATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1557.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13f5f3ac-e16b-4b7a-8b6d-6eaf129231e7
GitHub PoshC2ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1557.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2fb84998-3f4a-4ce8-9709-daa95d18186a
ADSecurity Windows Secure BaselineATTACK:enterprise:T1557.001 → subtechnique-of → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66506cb1-20d5-4cb2-b301-e4a5d2868567
ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1557.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--670a7586-5833-4e00-903a-c699b9810c13
Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1557.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a1dd165-a32a-405c-8c1b-c0a17c8ce710
ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1557.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9bd4212c-2e17-41e2-9ff3-1448642ce958
FireEye KEGTAP SINGLEMALT October 2020ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1557.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a9bbbd0f-3f45-4efa-9e6b-56ed2c9b9126
GitHub PupyATTACK:enterprise:S0174 → uses → ATTACK:enterprise:T1557.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aef7fe44-f381-41d5-88af-f04135e3aeab
GitHub ResponderATTACK:enterprise:M1030 → mitigates → ATTACK:enterprise:T1557.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4dfcece-bbcd-419a-9f29-0855ae096c76
ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1557.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f22a84ea-e4da-4a2c-8035-3eb972365bd3
Secure Ideas SMB Relay · Microsoft SMB Packet Signing · byt3bl33d3r NTLM Relaying