LLMNR and NBT-NS Poisoning is a name-resolution attack where a responder impersonates a host so victims send authentication material to the attacker. Defenders reduce risk by disabling these protocols where possible, segmenting networks, and watching for unexpected name-resolution responses, credential capture attempts, and unusual local broadcast traffic.
What the attack does
LLMNR and NBT-NS poisoning is a local name-resolution abuse pattern. The attacker answers queries faster than the real host, causing the victim to trust the rogue response and attempt authentication or other follow-on traffic to the attacker.
This works because both protocols are designed for convenience, not strong authentication. On flat or lightly segmented networks, that convenience can be turned into credential capture, relay opportunities, and reconnaissance of who is still relying on insecure broadcast-based resolution.
Why it matters in Windows environments
The risk is not just that a victim “talks to the wrong host.” The real issue is that name-resolution poisoning can place an attacker in the path of authentication flows, making hashes, challenge-response material, or session-related traffic available for capture or relay.
That is why defenders usually treat these protocols as exposure amplifiers rather than isolated nuisances. Where they remain enabled, they can widen the attack surface for lateral movement, especially when legacy name resolution still coexists with weak segmentation and permissive trust relationships.
How defenders identify exposure
Exposure checking starts with a clear inventory of where LLMNR and NBT-NS are still active, then confirming which subnets can reach one another and whether broadcast traffic is crossing boundaries that should limit it. Unexpected responders, repeated failed resolution attempts, and clients falling back to local broadcast answers are all signs worth examining.
Administrators should also review vendor and platform guidance for the operating systems and network services in scope. A machine that still relies on broadcast name resolution is not just a protocol issue, it is a sign that the environment may still be carrying assumptions that modern hardening has already invalidated.
Remediation and detection priorities
The most effective fix is to disable the protocols where the environment allows it, then reduce the conditions that make poisoning useful: segment the network, prefer authenticated name services, and eliminate unnecessary legacy broadcast dependence. For readers mapping this to broader lateral-movement hardening, the Lateral Movement Guide covers how name-resolution poisoning fits into the wider Windows attack chain.
Detection should focus on the attacker behaviour, not just the protocol name. Watch for unusual local broadcast responses, sudden name-resolution mismatches, and authentication attempts that follow suspicious resolution activity, then correlate those events with other signs of credential capture or relay preparation.
Risk and Threat Considerations
These attacks are especially dangerous because they exploit trust in local name resolution to redirect authentication material before the victim has any reason to suspect abuse. If the environment still accepts broadcast answers, a nearby attacker can create a low-noise path to credential capture or relay.
Failure mechanism: A client issues an unresolved name query, the attacker answers first, and the client sends authentication-related traffic to the rogue responder instead of the real host.
Impact: The attacker may capture hashes or other authentication material, relay those credentials into other services, or use the poisoned trust path as a foothold for lateral movement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1557.001 — Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay | Directly names the name-resolution poisoning technique in this term. |
| Recommendation — Map observed responses to T1557.001 and hunt for relay and credential-capture activity. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | The attack abuses authentication material from user logons and network services. |
| AC-4 — Information Flow Enforcement | Segmentation and traffic boundaries materially reduce the reach of broadcast poisoning. | |
| Recommendation — Require strong user authentication paths that do not rely on poisoned name resolution. Enforce flow restrictions that prevent broadcast name-resolution traffic from crossing unneeded boundaries. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Legacy name-resolution protocols and segmentation belong to network hardening and control. |
| Recommendation — Disable legacy broadcast resolution and harden network segmentation to limit poisoning opportunities. | ||
| NIST CSF 2.0 | PR.AA-05 — Authentication Confirms Identities | The term targets authentication material by abusing trust in name resolution. |
| Recommendation — Use authenticated name services so identity assertions do not depend on unauthenticated broadcast answers. | ||
Practitioner Guidance
What to watch for: Treat repeated name-resolution failures, unexpected local responders, and unexplained authentication attempts immediately after broadcast resolution as signs that poisoning may be underway. Those signals are more useful than looking for the protocol name in isolation, because the operational danger is the trust abuse that follows.
Governance implication: Ownership should sit with endpoint, network, and identity teams together, since the control problem spans host configuration, subnet design, and authentication exposure. If one team disables the protocol but another keeps flat connectivity and legacy dependencies in place, the attack path remains open.