1200KM / detection
T1557.001 Name Resolution Poisoning and SMB Relay — Detection Rules
Detection workspace for T1557.001 Name Resolution Poisoning and SMB Relay: 10 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Potential PetitPotam Attack Via EFS RPC Calls · test · medium · {"product":"zeek","service":"dce_rpc"}
- Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network · experimental · high · {"product":"zeek","service":"dns"}
- RottenPotato Like Attack Pattern · test · high · {"product":"windows","service":"security"}
- Local Privilege Escalation Indicator TabTip · test · high · {"product":"windows","service":"system"}
- Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing · experimental · high · {"product":"windows","category":"dns_query"}
- WinDivert Driver Load · test · high · {"category":"driver_load","product":"windows"}
- HackTool - ADCSPwn Execution · test · high · {"category":"process_creation","product":"windows"}
- HackTool - Impacket Tools Execution · test · high · {"category":"process_creation","product":"windows"}
- Potential SMB Relay Attack Tool Execution · test · critical · {"category":"process_creation","product":"windows"}
- Attempts of Kerberos Coercion Via DNS SPN Spoofing · experimental · high · {"category":"process_creation","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0462 Detect LLMNR/NBT-NS Poisoning and SMB Relay on Windows
AN1274 Analytic 1274
Detects anomalous network traffic on UDP 5355 (LLMNR) and UDP 137 (NBT-NS) combined with unauthorized SMB relay attempts, registry modifications re-enabling multicast name resolution, or suspicious service creation indicative of adversary-in-the-middle credential interception.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.