CmdID

CmdID / Techniques / T1557

T1557.001 Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay

By responding to LLMNR/NBT-NS/mDNS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. MITRE ATT&CK

4 Sigma rules T1557.001 on attack.mitre.org

Part of

MITRE ATT&CK
T1557Adversary-in-the-Middle

Sigma rules tagged with it

process creation, the highest levels first
criticalPotential SMB Relay Attack Tool ExecutionFlorian Roth (Nextron Systems) · Windows
highAttempts of Kerberos Coercion Via DNS SPN SpoofingSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highHackTool - ADCSPwn ExecutionFlorian Roth (Nextron Systems) · Windows
highHackTool - Impacket Tools ExecutionFlorian Roth (Nextron Systems) · Windows