---
name: rt-scenario-n002
description: "N-002: LLMNR/NBNS exposure assessment leading to credential-risk and lateral-movement impact analysis. Domain: network. Authorized internal scenario focused on detection, control validation, and remediation."
---

# N-002: LLMNR/NBNS Credential Exposure Risk

> Execute only on explicitly approved internal network segments. Do not collect, crack, or reuse real user credentials unless the SEAD specifically authorizes credential testing and defines handling rules.

## Overview

LLMNR, NBNS, and related legacy name-resolution behavior can cause clients to disclose authentication material to untrusted responders on the same network. This scenario evaluates whether the environment is vulnerable, how far the risk could extend, and which controls would break the chain.

| Field | Value |
|---|---|
| Domain | Network / Active Directory |
| Objective | Validate legacy name-resolution credential exposure risk |
| Required Access | Internal network presence |
| Detection Risk | Medium |
| Primary Impact | Credential exposure and possible lateral movement |

## Prerequisites

- Internal VLAN/subnet explicitly in scope.
- SOC/NOC notification completed if required.
- Credential handling rules defined.
- Test workstation or controlled lab user available.
- No production password cracking unless explicitly approved.

## Attack Chain Model

1. Attacker gains internal network position.
2. Clients attempt legacy name resolution.
3. Authentication material may be exposed to an untrusted responder.
4. Exposed credentials may enable access to additional hosts.
5. Lateral access may expose sensitive shares or admin interfaces.

## Safe Validation Workflow

### Step 1 - Confirm Protocol Posture

Review GPOs, endpoint configuration, and network monitoring for:

- LLMNR enabled/disabled.
- NetBIOS over TCP/IP enabled/disabled.
- mDNS exposure.
- SMB signing requirement.
- Local admin password uniqueness.

### Step 2 - Passive Observation

Where approved, observe whether clients emit legacy name-resolution requests. Record only metadata needed for proof:

- Timestamp.
- Segment.
- Protocol.
- Query name.
- Test host identifier.

### Step 3 - Controlled Test

Use a client-approved test machine or lab account to trigger a harmless name-resolution event and confirm whether the network would allow spoofed responses.

### Step 4 - Impact Modeling

Do not use real credentials by default. Model impact from:

- Password policy.
- Local admin reuse.
- SMB signing posture.
- EDR/SOC detection.
- Network segmentation.

## MITRE ATT&CK Mapping

| Phase | Tactic | Technique |
|---|---|---|
| Exposure | Credential Access | Adversary-in-the-Middle |
| Credential Use | Credential Access | Password Cracking |
| Movement | Lateral Movement | Valid Accounts |

## Evidence

Capture:

- GPO/configuration screenshots.
- Passive protocol observations.
- Test host proof.
- Detection or alert evidence if generated.

## Detection

- Legacy name-resolution requests from endpoints.
- Suspicious responder behavior.
- SMB authentication to unusual hosts.
- Authentication failures after capture attempts.

## Remediation

- Disable LLMNR and NetBIOS where possible.
- Require SMB signing.
- Deploy Windows LAPS or equivalent.
- Enforce strong password policy.
- Segment user networks.
- Alert on name-resolution poisoning patterns.

## Autodoc

```bash
python _rtexit/scripts/autodoc_engine.py log --skill rt-scenario-n002 --phase exploitation --cmd "LLMNR/NBNS posture validation" --output "legacy name resolution risk summary"
```

