1200KM / tool
NBTscan — Attack Tool
NBTscan is an open source tool that has been used by state groups to conduct internal reconnaissance within a compromised network.
Tool identity and evidence
Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.
Aliases: NBTscan
Existing author guides
No reviewed association in this snapshot.
Primary documentation
No reviewed association in this snapshot.
Connected ecosystem references
Linked tags
Documented actor use
Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.
- Turla · G0010 · Pinned relationship source (relationship--e515dc29-7a69-4d0f-8a2a-d27722f3bd6b)
- Threat Group-3390 · G0027 · Pinned relationship source (relationship--e7740e58-d87c-44c4-907c-f66b88851ffc)
- Lotus Blossom · G0030 · Pinned relationship source (relationship--a20e2809-ec0d-4378-8ee2-0691b651236c)
- APT39 · G0087 · Pinned relationship source (relationship--05509bce-dc88-4cc9-8c39-40549cbc8603)
- GALLIUM · G0093 · Pinned relationship source (relationship--cc443415-7c35-49ab-92a9-3d0cfa68c7b2)
- Mustang Panda · G0129 · Pinned relationship source (relationship--d63355e9-94d1-4eb2-b24d-d8c8b11923ef)
- Tonto Team · G0131 · Pinned relationship source (relationship--c20cc0d1-fe0b-4683-b6ed-bbb8736fe2ca)
- BackdoorDiplomacy · G0135 · Pinned relationship source (relationship--8b26be81-0112-43be-a3e5-a94d5b15c738)
- Earth Lusca · G1006 · Pinned relationship source (relationship--e1130af1-b49f-4106-8846-7f3e65a65535)
- Agrius · G1030 · Pinned relationship source (relationship--0a23a684-c5e4-4ef1-8eb3-f55024cc71d5)
Technique-specific simulations and detections
Detection links describe the associated behavior, not independently verified tool-specific signatures.
- T1016 · System Network Configuration Discovery · Detection rules & anomalies
- T1018 · Remote System Discovery · Detection rules & anomalies
- T1033 · System Owner/User Discovery · Detection rules & anomalies
- T1040 · Network Sniffing · Detection rules & anomalies
- T1046 · Network Service Discovery · Detection rules & anomalies
Telemetry context
Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.