T1557.001 — Name Resolution Poisoning and SMB Relay

Tactics: Credential Access, Collection · Platforms: Windows

By responding to LLMNR/NBT-NS/mDNS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. This activity may be used to collect or relay authentication materials. Link-Local Multicast Name Resolution (LLMNR) and…

Sub-technique of Adversary-in-the-Middle (T1557).

Sigma detection rules (1)

T1557.001 Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay

title: "T1557.001 Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay"
id: eca58031-6a3e-4e14-be8e-210cfad41e96
description: 'Detects non-svchost/System processes connecting on LLMNR (5355)/mDNS (5353)/NBT-NS (137), indicative of a rogue responder tool. (Data Component: Network Connection; baseline tier: windows-eventid.) Tune using: TrustedResponderList, TimeWindow, SMBServiceBaseline.'
references:
  - https://attack.mitre.org/techniques/T1557/001
author: Shahrukh Khan
date: 2026-03-04
license: MIT
tags:
  - attack.credential-access
  - attack.collection
  - attack.t1557.001

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '3'
    DestinationPort:
      - 5355
      - 5353
      - 137
  filter_svchost:
    Image|endswith: '\svchost.exe'
  filter_system:
    Image: 'System'
  condition: selection and not 1 of filter_*

falsepositives:
  - Legitimate mDNS/Bonjour services, network printers, IoT discovery agents.

level: medium

Related sub-techniques

Explore