Detect it by watching for abnormal name-resolution replies, authentication attempts redirected to unexpected hosts, and SMB sessions that are relayed without normal user interaction. Defenders should disable unnecessary legacy name-resolution protocols, require SMB signing where possible, and monitor for repeated credential challenges, host impersonation, and lateral movement immediately after poisoning activity.
How to Spot Poisoned Name Resolution and SMB Relay in Practice
Detection works best when you correlate network, authentication, and endpoint behavior rather than looking for a single noisy alert. Poisoning usually shows up as unusual name-resolution answers, while relay shows up as a valid authentication flow being redirected to a host the user never intended to contact. The key is to treat those two steps as one attack chain.
Watch for replies to LLMNR, NBNS, or similar legacy queries coming from hosts that are not legitimate name-resolution services, especially when those replies are followed by NTLM authentication to the same unexpected endpoint. That pattern is more meaningful than isolated packet captures because it shows coercion, redirection, and attempted reuse of the challenge-response flow.
Relay activity often becomes visible when SMB sessions are established without the normal human interaction you would expect for that resource, or when a workstation suddenly begins authenticating to a peer immediately after a poisoned name lookup. The most useful signal is a short time window that links the poisoning event to repeated authentication challenges, host impersonation, and then lateral movement attempts.
What Logs and Network Patterns Matter Most
Look for sudden spikes in unresolved name lookups, repeated broadcasts for the same target, and responses that do not match the local subnet or expected infrastructure. On the authentication side, pay attention to SMB connections that appear after name-resolution failures, especially when the destination host is not in your approved server list or when the initiating user did not start a file-share action.
Lateral Movement Guide is useful here because it ties name-resolution poisoning and smb relay to the broader Windows lateral-movement techniques defenders actually see in investigations. That broader view helps you separate benign chatter from the sequence that matters: discovery, redirection, authentication reuse, and movement.
Endpoint telemetry can help confirm whether the authentication was truly relayed rather than user-driven. If the same account starts authenticating to multiple systems in quick succession, or if the SMB connection arrives with no corresponding user action, you should treat that as a strong indicator that the session was brokered by an attacker-controlled responder or relay point.
Reducing Exposure and Confirming an Attack Path
The most reliable way to limit this class of abuse is to remove the conditions that make poisoning and relay useful. Disabling unnecessary legacy name-resolution protocols reduces the chance that clients will accept forged answers, and requiring SMB signing where possible raises the bar for relayed authentication. If you cannot enforce those protections everywhere, segment the environment so one compromised workstation cannot easily reach high-value SMB targets.
From a hunting perspective, confirm whether the suspicious authentication led to privileged access, administrative share use, or subsequent remote execution. Poisoning alone is a precursor; the real containment question is whether it was followed by usable access that could be turned into file manipulation, service control, or credential harvesting.
MITRE ATT&CK Enterprise Matrix is a good external reference for mapping what you observe to credential access and lateral movement behavior, while SANS Security Resources provides practical detection and incident-response material for the operational follow-through after you confirm relay activity.
Risk and Threat Considerations
Poisoned name resolution is risky because it turns normal local-network trust into an access path, and SMB relay is dangerous because it can reuse that trust without needing the attacker to know the victim’s password. The combination can silently convert a workstation broadcast into lateral movement against file shares, management services, or other SMB-exposed systems.
Failure mechanism: Legacy name-resolution protocols accept forged replies, then SMB or NTLM authentication is redirected to an attacker-controlled host that relays the session to a third party before the user notices.
Impact: Defenders may see what looks like ordinary authentication while the attacker gains authenticated access, enabling unauthorized file access, service abuse, privilege escalation, or further spread across the network.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1021.002 — SMB/Windows Admin Shares | Covers SMB-based lateral movement that relay can enable. |
| T1557.001 — LLMNR/NBT-NS Poisoning and SMB Relay | Directly matches the poisoning-plus-relay technique in the question. | |
| Recommendation — Hunt for SMB-based lateral movement after suspicious name-resolution poisoning. Correlate poisoned name-resolution replies with relayed authentication attempts. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Supports disabling legacy resolution protocols and hardening SMB exposure. |
| Recommendation — Disable unnecessary legacy name-resolution services and restrict SMB reachability. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Applies to detecting abnormal name-resolution and relay indicators in logs and network telemetry. |
| SC-7 — Boundary Protection | Applies to limiting where poisoning traffic can travel and where SMB sessions can reach. | |
| Recommendation — Monitor for anomalous name-resolution replies and relayed authentication patterns. Segment SMB paths and constrain trust boundaries to reduce relay opportunity. | ||
Practitioner Guidance
What to verify: Confirm whether the suspicious destination host is legitimate for the requesting client, whether the authentication occurred after a name-resolution response, and whether SMB signing was enforced on the path that was used. If any of those answers is no, treat the session as potentially relayed rather than merely unusual.
Decision rule: If poisoning activity and SMB authentication are linked in time, prioritize containment and lateral-movement hunting before you spend time on root-cause attribution. The question is not only whether the lookup was spoofed, but whether the spoofed flow already produced a usable session.
Practitioner takeaway: The most useful detection is correlation, because poisoning is the setup and relay is the payoff; teams that only alert on the broadcast anomaly will miss the authentication path that actually creates compromise.