1200KM / tool
NBTscan — Attack Tool
NBTscan is an open source tool that has been used by state groups to conduct internal reconnaissance within a compromised network.
Tool identity and evidence
Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.
Aliases: NBTscan
Existing author guides
No reviewed association in this snapshot.
Primary documentation
No reviewed association in this snapshot.
Connected ecosystem references
Linked tags
Documented actor use
Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.
- Turla · G0010 · Pinned relationship source (relationship--e515dc29-7a69-4d0f-8a2a-d27722f3bd6b)
- Threat Group-3390 · G0027 · Pinned relationship source (relationship--e7740e58-d87c-44c4-907c-f66b88851ffc)
- Lotus Blossom · G0030 · Pinned relationship source (relationship--a20e2809-ec0d-4378-8ee2-0691b651236c)
- APT39 · G0087 · Pinned relationship source (relationship--05509bce-dc88-4cc9-8c39-40549cbc8603)
- GALLIUM · G0093 · Pinned relationship source (relationship--cc443415-7c35-49ab-92a9-3d0cfa68c7b2)
- Mustang Panda · G0129 · Pinned relationship source (relationship--d63355e9-94d1-4eb2-b24d-d8c8b11923ef)
- Tonto Team · G0131 · Pinned relationship source (relationship--c20cc0d1-fe0b-4683-b6ed-bbb8736fe2ca)
- BackdoorDiplomacy · G0135 · Pinned relationship source (relationship--8b26be81-0112-43be-a3e5-a94d5b15c738)
- Earth Lusca · G1006 · Pinned relationship source (relationship--e1130af1-b49f-4106-8846-7f3e65a65535)
- Agrius · G1030 · Pinned relationship source (relationship--0a23a684-c5e4-4ef1-8eb3-f55024cc71d5)
Technique-specific simulations and detections
Detection links describe the associated behavior, not independently verified tool-specific signatures.
- T1016 · System Network Configuration Discovery · Detection rules & anomalies
- T1018 · Remote System Discovery · Detection rules & anomalies
- T1033 · System Owner/User Discovery · Detection rules & anomalies
- T1040 · Network Sniffing · Detection rules & anomalies
- T1046 · Network Service Discovery · Detection rules & anomalies
Telemetry context
Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.