CmdID

CmdID / Commands

nbtstat

Displays NetBIOS over TCP/IP (NetBT) protocol statistics, NetBIOS name tables for both the local computer and remote computers, and the NetBIOS name cache. Windows commands reference

On Windows 1 Sigma rule name it File nbtstat.exe

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0

Displays NetBIOS over TCP/IP (NetBT) protocol statistics, NetBIOS name tables for both the local computer and remote computers, and the NetBIOS name cache. This command also allows a refresh of the NetBIOS name cache and the names registered with Windows Internet Name Service (WINS). Used without parameters, this command displays Help information. This command is available only if the Internet Protocol (TCP/IP) protocol is installed as a component in the properties of a network adapter in Network Connections.

nbtstat [/a <remotename>] [/A <IPaddress>] [/c] [/n] [/r] [/R] [/RR] [/s] [/S] [<interval>]
nbtstat /a CORP07
nbtstat /A 10.0.0.99
nbtstat /n
nbtstat /c
nbtstat /R
nbtstat /RR
nbtstat /S 5
/a <remotename>Displays the NetBIOS name table of a remote computer, where remotename is the NetBIOS computer name of the remote computer. The NetBIOS name table is the list of NetBIOS names that corresponds to NetBIOS applications running on that computer.
/A <IPaddress>Displays the NetBIOS name table of a remote computer, specified by the IP address (in dotted decimal notation) of the remote computer.
/cDisplays the contents of the NetBIOS name cache, the table of NetBIOS names and their resolved IP addresses.
/nDisplays the NetBIOS name table of the local computer. The status of registered indicates that the name is registered either by broadcast or with a WINS server.
/rDisplays NetBIOS name resolution statistics.
/RRReleases and then refreshes NetBIOS names for the local computer that is registered with WINS servers.
/sDisplays NetBIOS client and server sessions, attempting to convert the destination IP address to a name.
<interval>Displays selected statistics, pausing the number of seconds specified in interval between each display. Press CTRL+C to stop displaying statistics. If this parameter is omitted, nbtstat prints the current configuration information only once.
/?Displays help at the command prompt.

What detects it

Sigma process creation rules that name nbtstat
highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)