Attackers use name resolution poisoning and SMB relay to capture authentication and forward it to another service that will accept it. They exploit systems that broadcast or trust spoofed name responses, then relay credentials to gain access without knowing the password. Defenders should disable insecure name resolution, require SMB signing where possible, and watch for unexpected authentication relays.
How name resolution poisoning helps the relay step
name resolution poisoning works because some Windows hosts will ask the local network who a name belongs to, then trust the first believable response they receive. Attackers answer those queries with a spoofed target, so the victim sends authentication to the attacker instead of to the real service. The poisoning step is usually not the end goal, it is the setup that makes relay possible.
Relay becomes useful when the attacker can forward that captured authentication to another service that accepts it without requiring a password replay in the usual sense. That means the attacker does not need to crack the credential, only to preserve enough of the authentication flow for the next service to accept it. In practice, the attack succeeds when the target service and protocol allow the authentication material to be reused in transit.
For lateral movement context, Lateral Movement Guide covers the common Windows paths where poisoned discovery and relayed authentication are chained into broader access.
Why SMB relay remains effective in mixed Windows environments
smb relay is effective when organisations leave weak trust assumptions in place around name resolution, NTLM-based authentication, or SMB signing. The attacker positions themselves between the victim and the destination, captures the negotiated authentication, and relays it to the real service before the session expires or the protocol rejects the relay attempt.
The important practitioner detail is that relay is not a generic credential theft technique. It is an access-path abuse technique. If the destination service enforces protections such as SMB signing, or if the environment no longer relies on insecure broadcast-based name resolution, the relay chain becomes much harder to execute. That is why defenders usually have to reduce both the poisoning opportunity and the relay opportunity.
Attack chains that combine spoofing, relay, and credential reuse are part of the broader patterns covered in The State of NHI & AI Agent Breach Report 2026, especially where stolen authentication material is used to move laterally after initial capture.
What defenders should verify before treating this as closed
Disabling insecure name resolution is only part of the fix. Teams should also verify whether any critical SMB paths still accept unsigned traffic, whether relayable services remain exposed to the same broadcast domain, and whether legacy authentication fallback is still enabled anywhere that matters. A single hardening gap can preserve the attack path even when the obvious poisoning vector has been reduced.
Detection also matters because relay attempts are often visible as suspicious authentication patterns rather than as overt malware activity. Unexpected NTLM authentication, unusual source-to-destination pairings, or a workstation receiving authentication intended for a different host can all be early indicators that the environment is being used as a relay target or is already being probed.
Risk and Threat Considerations
Name resolution poisoning and smb relay are high-leverage because they turn ordinary trust on the local network into unauthorized access. The main risk is not just credential capture, but access without password knowledge, which can bypass assumptions built into account monitoring and incident response.
Failure mechanism: A spoofed name response diverts authentication to the attacker, and an unsigned or relay-tolerant SMB path accepts the forwarded authentication before the victim or defender can intervene.
Impact: Attackers can gain authenticated access, pivot to additional hosts, and escalate the blast radius from a single poisoned session into broader lateral movement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1557 — Adversary-in-the-Middle | Covers name resolution poisoning and relay as adversary-in-the-middle access abuse. |
| Recommendation — Map observed poisoning and relay activity to T1557 and hunt for man-in-the-middle access paths. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | SMB relay succeeds when access controls and protocol hardening remain weak. |
| Recommendation — Restrict insecure authentication paths and require stronger access controls on SMB services. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Relay abuse depends on exploitable authentication material and weak authenticator handling. |
| SC-23 — Session Authenticity | Relay attacks exploit trust in session establishment and message authenticity. | |
| AC-17 — Remote Access | Relayed authentication commonly becomes useful through remote service access paths. | |
| Recommendation — Strengthen authenticator handling and limit reuse of authentication material across services. Protect session authenticity so relayed authentication cannot be accepted by other services. Constrain remote access paths that can be reached with relayed credentials. | ||
Practitioner Guidance
What to verify: Confirm where insecure name resolution is still enabled, which services still accept SMB without signing, and whether any systems on the same network segment can be induced to authenticate to an untrusted listener. That combination, not the individual technique alone, determines whether the relay path is viable.
Decision rule: If a target service accepts relayed authentication, treat the issue as an access-control weakness as well as a network-hardening issue. If the service will not accept the relay, focus on removing the poisoning opportunity and monitoring for reconnaissance or failed relay attempts instead of assuming the risk is gone.
Practitioner takeaway: The key control objective is to break the chain at more than one point, because poisoning and relay are mutually reinforcing, and stopping only one side often leaves a usable attack path.