Name Resolution Poisoning and SMB Relay is an attack chain where spoofed name resolution tricks a system into authenticating to an attacker, who then relays the session to another service. It is used to capture or forward credentials and gain unauthorised access. Defenders should disable unsafe name resolution methods, require signing where possible, and watch for relay patterns.
Name Resolution Poisoning and SMB Relay in practice
name resolution poisoning works because many Windows environments still trust local broadcast or fallback name lookups long enough to send authentication to the wrong host. The relay step then turns that mistaken trust into usable access, especially where the target service accepts NTLM without strong channel binding or signing.
That makes the chain more than a nuisance, it is a movement technique that can convert a single on-path or local spoof into access against file shares, remote administration services, or other internal systems. In a chained attack, the first success is often not data theft but the creation of a reusable authentication path.
Why this attack chain is effective
The power of this technique comes from combining two weak assumptions: that name resolution answers are trustworthy, and that the resulting authenticated session can be safely relayed. When both assumptions hold, the attacker does not need to crack a password, only to position themselves between a client and the service it wants to reach.
That is why defenders treat this as a trust-boundary failure, not just a protocol quirk. The attack can succeed during routine endpoint activity, without the user noticing anything unusual, because the victim system believes it is talking to an intended internal host.
Where organisations are exposed
Exposure usually appears where legacy discovery and authentication choices remain enabled together. Common examples include hosts that still answer or accept spoofable name resolution, internal services that permit ntlm relay paths, and environments where SMB hardening is incomplete or unevenly deployed.
Broad visibility matters here because the risk is often environmental rather than one-off. The same misconfiguration pattern can affect many endpoints, many subnets, and several internal services at once, which makes it a good candidate for lateral movement once the first foothold is established. For deeper tradecraft context, the Lateral Movement Guide covers smb relay, NTLM relay, and related Windows administration paths.
Defensive controls and verification
Practical defence starts with removing the easy spoofing paths and then tightening the services that might accept a relayed authentication. The key idea is to reduce both the chance of misdirection and the value of any intercepted session.
- Prefer authenticated, hardened name resolution paths over broadcast or fallback methods where possible.
- Require SMB signing and other protocol protections wherever the service and client support them.
- Inventory internal services that still accept NTLM or similar relay-prone authentication flows.
- Monitor for suspicious name resolution traffic, unexpected authentication targets, and relay-style follow-on access.
Risk and Threat Considerations
This attack chain matters because it can convert a local spoof into authenticated internal access, which is a strong precursor to lateral movement, privilege abuse, and credential harvesting. The same relay condition can also undermine the reliability of normal trust signals in internal traffic, making detection harder if defenders rely only on successful logons as proof of legitimacy.
Failure mechanism: An attacker poisons name resolution so a victim authenticates to the attacker instead of the intended host, then relays that session to a second service that accepts the forwarded authentication.
Impact: The attacker may gain unauthorised access to internal services, access sensitive shares or administration channels, and establish a foothold for further movement across the network.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1557 — Adversary-in-the-Middle | Covers spoofed resolution and relayed authentication as an interception attack |
| T1021 — Remote Services | Covers post-relay use of internal remote service access for lateral movement | |
| Recommendation — Detect adversary-in-the-middle patterns and hunt for relayed authentication to internal services. Monitor remote service access paths for unusual authentication and lateral movement after relay success. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Applies where user authentication is being intercepted and reused against internal services |
| SC-8 — Transmission Confidentiality and Integrity | Supports protecting authentication traffic from interception and tampering in transit | |
| SC-23 — Session Authenticity | Directly addresses session hijacking and relay conditions created by spoofed network responses | |
| Recommendation — Enforce stronger user authentication requirements that reduce reliance on relayable sessions. Protect authentication traffic with integrity controls that make relay and tampering harder. Apply session authenticity controls to reduce acceptance of relayed or redirected sessions. | ||
Practitioner Guidance
What to watch for: Treat this chain as an environment-level control problem, not just an endpoint event. If a single poisoned lookup can reach a service that still trusts relayed authentication, the weakest host can become a path into stronger systems.
Practitioner takeaway: The most effective reductions come from hardening both ends of the chain, the spoofable name-resolution step and the relayable authentication target, because closing only one often leaves a workable path for the attacker.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org