LLMNR and NBT-NS Poisoning: NTLM Relay to SMB

A security alert fired for anomalous NTLM activity on the file server. Before diving into any individual log, establish the scope: which internal hosts are involved and what timeframe covers the suspicious activity.

The entire attack chain began with a single failed DNS lookup. Identify the exact hostname the victim workstation was trying to reach when DNS returned no answer and fallback broadcasting began.

The attacker did not just capture the credential -- they forwarded it somewhere immediately. Identify the internal server that accepted the relayed authentication.

NTLM relay only works against SMB targets where a specific security feature is absent. Confirm from the PCAP negotiate phase whether that feature was required on the file server.

Responder writes the captured NetNTLMv2 hash to a file on the attacker's machine for later offline cracking. Identify that file from the XDR endpoint artifacts.

After establishing the relay session, the attacker ran secretsdump against the file server. Identify the MITRE ATT&CK sub-technique that best describes this remote SAM extraction via DCE-RPC.

Map the complete LLMNR poisoning and NTLM relay chain to its MITRE ATT&CK technique identifier.