Task: Analyze network traffic for LLMNR/NBT-NS poisoning attacks using Wireshark to identify the rogue machine, compromised accounts, and affected systems.

Category: Network Forensics

Tactics: Credential Access, Collection

Tool: Wireshark

Scenario

Your organization's security team has detected a surge in suspicious network activity. There are concerns that LLMNR (Link-Local Multicast Name Resolution) and NBT-NS (NetBIOS Name Service) poisoning attacks may be occurring within your network. These attacks are known for exploiting these protocols to intercept network traffic and potentially compromise user credentials. Your task is to investigate the network logs and examine captured network traffic.

1. Executive Summary

This report documents the forensic investigation of a protocol poisoning incident. The attack exploited legacy name resolution protocols—LLMNR (Link-Local Multicast Name Resolution) and NBT-NS (NetBIOS Name Service)—to perform a Man-in-the-Middle (MitM) attack. By intercepting broadcast queries and providing spoofed responses, an adversary was able to redirect traffic and harvest NTLMv2 authentication hashes from domain users.

2. Technical Context: The Attack Vector

In Windows environments, when a DNS resolution fails, the system falls back to LLMNR and NBT-NS broadcasts to find the resource on the local subnet. Because these protocols lack authentication, an attacker running a tool like Responder can:

  1. Listen for broadcast queries.
  2. Respond with their own IP, claiming to be the requested resource.
  3. Force the victim to authenticate via SMB/HTTP, exfiltrating the user's NTLM hash.

3. Forensic Analysis & Discovery

I. Identifying the Initial Trigger (The Mistyped Query)

The investigation began by filtering for NetBIOS Name Service (NBNS) traffic to identify the source of the anomaly.