Attackers use LLMNR/NBT-NS poisoning and relay by answering local name-resolution requests with fraudulent responses and relaying authentication to other systems. Defenders should disable these protocols where possible, prefer DNS, and monitor for suspicious broadcast poisoning and relay attempts. Segment networks, enforce signing and strong authentication, and investigate unexpected credential exposure on local subnets.
How LLMNR/NBT-NS poisoning and relay works
LLMNR and NBT-NS are fallback name-resolution mechanisms, so they become attractive when hosts cannot resolve a name through DNS. Poisoning works by replying faster than the legitimate responder and supplying a malicious answer that points the victim toward the attacker instead of the intended service. Relay then forwards the victim’s authentication to a different target that will accept it.
The practical danger is not the broadcast response itself, but the trust chain it creates. Once a workstation accepts the spoofed resolution, the attacker can capture a challenge-response exchange and relay it to a second host, often turning a simple name lookup into an authenticated session against file shares, remote management services, or other reachable systems.
This is why name-resolution weaknesses and lateral movement often appear together. In environments that still rely on legacy fallback protocols, attackers can combine the Lateral Movement Guide with relay tooling to move from one subnet to another without needing to crack a password first.
Why the attack succeeds on flat or poorly segmented networks
These attacks work best when clients are allowed to broadcast unresolved names broadly and when internal systems accept relayed authentication without additional protections. The more open the local subnet, the easier it is for an attacker to see requests, answer them, and pivot the resulting authentication elsewhere.
Relay becomes especially effective where services accept NTLM-based authentication and lack protections such as signing, channel binding, or other controls that bind the authentication to the intended endpoint. In that case, the victim may authenticate successfully, but not to the system the user intended to reach.
The Network Ports and Protocols Security Guide is useful here because the attack depends on ordinary internal protocol behaviour, not exotic exploitation. If the network still permits weak internal name resolution and legacy authentication paths, the attacker only needs a foothold on the local segment.
How defenders reduce the relay window
The cleanest mitigation is to remove the opportunity for poisoning in the first place. Prefer DNS, disable LLMNR and NBT-NS where operationally possible, and reduce dependence on legacy authentication paths that can be relayed across systems. Segmentation matters because it shrinks who can observe and answer local broadcast traffic.
On the target side, hardening is about making relayed authentication less useful. Enforce signing where supported, require stronger authentication where feasible, and restrict services so that a relayed session cannot simply become a reusable administrative foothold. Watch for broadcast poisoning, unexpected name-resolution failures, and authentication attempts that originate from hosts that should never be acting as responders.
The Lateral Movement Guide complements that hardening view because relay is usually only the opening move. The real objective is often access to SMB, remote execution, or admin shares after the initial spoofed lookup succeeds.
Risk and Threat Considerations
LLMNR/NBT-NS poisoning is risky because it turns local broadcast traffic into a credential interception path, and relay can convert that interception into unauthorized access on another host. The weakness is most dangerous on internal networks where legacy authentication and broad east-west connectivity still exist.
Failure mechanism: A client accepts a forged name-resolution reply, then authenticates to the attacker’s listener, which relays that authentication to a second service that does not properly bind the session to the original endpoint.
Impact: Attackers can gain unauthorized access, move laterally, or reach privileged services without knowing the underlying password, especially when signing or endpoint protections are missing.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1557 — Adversary-in-the-Middle | Poisoning and relay are classic adversary-in-the-middle access techniques. |
| Recommendation — Map poisoning and relay activity to T1557 and hunt for interception on local subnets. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Disabling legacy name resolution and segmenting networks are infrastructure hardening actions. |
| Recommendation — Segment internal networks and disable legacy broadcast name resolution where possible. | ||
| NIST SP 800-53 Rev 5 | SC-8 — Transmission Confidentiality and Integrity | Relay abuse exploits weak binding between authentication traffic and its destination. |
| IA-2 — Identification and Authentication (Organizational Users) | Relayed credentials are used to impersonate users against internal services. | |
| IA-5 — Authenticator Management | Credential exposure and reuse are central to relay-driven compromise paths. | |
| Recommendation — Enforce protections that preserve the integrity of authentication traffic in transit. Require stronger user authentication and reduce acceptance of relayed sessions. Rotate and manage authenticators so captured sessions are less useful to attackers. | ||
Practitioner Guidance
What to prioritise: Start with hosts and subnets where fallback name resolution is still enabled and where NTLM-based authentication is accepted. Those are the conditions that make poisoning and relay operationally viable, so they should be your first exposure check.
What to verify: Confirm that DNS is the normal path for internal resolution, then validate that legacy broadcast resolution is disabled or tightly constrained. Also verify which services still accept relayed authentication, because the attacker’s value comes from the target service, not just the spoofed response.
Decision rule: If a workstation or server can be tricked into authenticating to a hostile responder on the local subnet, treat that path as a credential exposure problem first and an incident investigation second. If suspicious auth already occurred, preserve logs and review nearby hosts for follow-on access attempts.
Practitioner takeaway: LLMNR/NBT-NS poisoning is rarely the whole attack, it is the doorway. The security decision is whether your internal network still allows a broadcast-based trust shortcut to become authenticated access elsewhere.