NTLM Hash Harvesting (LLMNR/NBT-NS Poisoning and NTLMv1 Downgrade) Response
Responds to a hash harvesting attack by detecting NetNTLM hashes collected via LLMNR/NBT-NS poisoning or NTLMv1 downgrade, rotating exposed accounts, and closing the broadcast surface.
Prepare
5 steps- Enable NTLM audit policies
Enable the "Audit NTLM authentication in this domain" (EID 8004) and "Audit NTLM authentication in this domain: Audit all" policies; export an environment-specific NTLM usage baseline
- Maintain a legitimate NTLM dependency inventory
Document expected source-account pairs for backup agents, printers, legacy applications, and multi-user servers — detection rule FP tuning relies on this inventory
- Deploy LLMNR/NBT-NS decoy sensor
Set up a fake name resolution signal on a monitored subnet using Respounder or ResponderGuard; detects hash harvesting via network poisoning
- Verify Sysmon EID 13 (registry set) configuration
Monitors `HKLM\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel`, `NtlmMinClientSec`, `RestrictSendingNTLMTraffic` keys; mandatory for NTLMv1 downgrade detection
- Keep the escalation chain ready
SOC L1 → L2/IR lead → AD admin → CISO; the activity decision (is there an active relay?) is not made by L1 alone — L2/IR approval is mandatory