ADNET-006: NetBIOS over TCP/IP Configuration Reviewed
- Platform
- Active Directory
- Category
- AD Network & Relay Preconditions
- Severity
- Medium
- Zero Trust pillar
- Networks (weight 3)
- Golden fixtures
- 2
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
The check evaluates three artifacts that, in combination, represent the only practical fleet-wide methods of disabling NetBIOS over TCP/IP on domain-joined workstations. First, it enumerates Group Policy Preferences (GPP) registry items under each linked GPO by reading \\<domain>\SYSVOL\<domain>\Policies\<GUID>\Machine\Preferences\Registry\Registry.xml and searching for entries that target HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\Tcpip_* with value name NetbiosOptions set to 2 (disabled). Second, it reads the DHCP server inventory (when the operator passes the DHCP server names or the check is run against the DHCP host) and inspects each scope for option 001 (the Microsoft-defined "Microsoft Disable Netbios Option") set to value 0x2. Third, it looks for documented imaging-baseline evidence such as an MDT customsettings.ini, a System Center Configuration Manager (SCCM/MECM) task sequence step, or a Configuration Manager baseline that toggles the NetBT NetbiosOptions registry value on first boot. The check is read-only: it does not modify GPO, DHCP, or imaging configuration. It does not test individual workstations because endpoint posture is the domain of ADNET-007. The output is a single boolean ("domain-wide method present yes/no") plus a list of every artifact discovered, so the operator can confirm coverage extends across the entire DHCP-leased estate, not just a subset.
Why it matters
NetBIOS-NS poisoning is the workhorse of internal network compromise. In Mandiant M-Trends, SpecterOps engagement retrospectives, and TrustedSec red-team reports, Responder against NBT-NS is the single most common technique for harvesting credentials on a flat corporate VLAN with no prior foothold beyond an Ethernet jack or a Wi-Fi PSK. The protocol design is the vulnerability: NBT-NS uses UDP 137 broadcast for name resolution with no authentication of responses, so any host on the broadcast domain that answers first wins the race. Once an attacker becomes the destination of a misdirected SMB connection (typically a mistyped server name, a stale DFS reference, a roaming profile path, a printer queue, or a Web Proxy Auto-Discovery query), the victim performs NTLM authentication directly to the attacker, who captures the Net-NTLMv2 challenge response. That hash is then either cracked offline with hashcat (-m 5600, viable for any password under roughly 12 characters of mixed entropy) or relayed live to a target that does not enforce SMB signing (ntlmrelayx -t smb://fileserver), to an LDAP service without channel binding (ntlmrelayx -t ldap://dc01 -ip <attacker>), or to an Exchange or ADCS HTTP endpoint (PetitPotam-style coercion to CVE-2021-36942 ESC8 relay), yielding a foothold as the relayed user. Disabling LLMNR alone (ADNET-005) is insufficient because Windows falls through to NBT-NS as the next leg of name resolution. Both legs must be closed for the kill chain to be broken at the protocol level. Leaving NetBIOS enabled domain-wide turns every poorly-segmented broadcast domain into a credential-harvesting opportunity for any adversary who gains an L2 presence, which in modern environments includes BYOD, IoT, contractor laptops, and physically accessible network jacks.
Attack path
Step 1: L2 presence. The attacker has any device on the same broadcast domain as Windows clients. This is trivial in flat office networks, in conference rooms, on guest VLANs that share subnets with corporate, on Wi-Fi where client isolation is not enforced, on a compromised printer, or on a Raspberry Pi dropped under a desk. Step 2: Start the poisoner. responder -I eth0 -wrf (Responder), or Invoke-Inveigh -ConsoleOutput Y -NBNS Y -mDNS Y -LLMNR Y (Inveigh PowerShell), or ntlmrelayx.py -tf targets.txt -smb2support combined with mitm6 or Responder for the poisoning layer. The tool answers NBT-NS queries (UDP 137 broadcast) and LLMNR queries (UDP 5355 multicast) for any name not already cached by the victim. Step 3: Wait for a name miss. Windows clients constantly try to resolve names that do not exist in DNS: WPAD (Web Proxy Auto-Discovery), mistyped server names, decommissioned file shares still referenced in scheduled tasks, printer queues, roaming profiles, group policy preferences targeting old hostnames, mapped drives in login scripts. Each miss triggers NBT-NS broadcast within seconds of a user logging in. On a 500-seat floor, Responder captures dozens of hashes per hour with no user interaction. Step 4a (crack). The captured Net-NTLMv2 hash is fed to hashcat -m 5600 hashes.txt wordlist.txt -r rules/best64.rule. Service-account passwords, helpdesk accounts, and any user with a password under 12 characters of mixed entropy fall in minutes to hours. Step 4b (relay). For accounts whose hash will not crack, the attacker relays live: ntlmrelayx.py -t smb://fileserver01 -smb2support -socks captures an authenticated SMB session as the victim against any target server that does not enforce SMB signing (ADNET-002). Relaying to LDAP without channel binding (ADNET-003) yields the ability to add a new computer account and write msDS-AllowedToActOnBehalfOfOtherIdentity for RBCD takeover. Relaying to ADCS web enrollment (ESC8, CVE-2021-36942) yields a certificate as the victim, which is then used to authenticate as any user including Domain Admins. Step 5: Pivot. The cracked or relayed credential is used for lateral movement: psexec, wmiexec, PowerShell Remoting, RDP. Within a single shift the attacker typically reaches a service account with administrative rights on a tier-1 server, from which Kerberoasting (ADKERB-001) or DCSync via a delegated ACL (ADACL-005) yields Tier 0. Step 6: Persistence and re-poisoning. The attacker leaves the poisoner running for a multi-day capture window, optionally with -Analyze mode that records hashes without responding (to avoid setting off Microsoft Defender for Identity alerts on Responder activity), and reactivates response mode during business hours when capture density is highest.
How Guerrilla assesses it
Guerrilla performs three discovery passes. First (GPP enumeration): for each GPO returned by Get-GPO -All, the check downloads \\<domain>\SYSVOL\<domain>\Policies\{GUID}\Machine\Preferences\Registry\Registry.xml and parses each <Registry> element looking for properties where key matches "SYSTEM\\CurrentControlSet\\Services\\NetBT\\Parameters\\Interfaces\\Tcpip_" and name equals "NetbiosOptions" with type REG_DWORD and value 2. It records the GPO display name, GUID, link scope (which OUs the GPO is linked to), and security filtering so the operator can confirm the policy actually reaches workstations rather than only one OU. Second (DHCP option scan): when the check is run against, or pointed at, a Microsoft DHCP server, it invokes Get-DhcpServerv4OptionValue -ScopeId <each scope> and inspects OptionId 1 in vendor class "Microsoft Windows 2000 Options" for the value 0x2 (disable NetBIOS over TCP/IP); it does the same for IPv4 server-level defaults via Get-DhcpServerv4OptionValue -All. Third (imaging baseline): the check inspects well-known paths for MDT (\\<server>\DeploymentShare$\Control\CustomSettings.ini for a NetbiosOptions=2 line) and SCCM (the Configuration Manager site provider for task sequence steps and configuration baselines that target the NetBT registry value). The check passes only if at least one of the three artifacts is present and the artifact targets the workstation OUs (not just servers, not just domain controllers). When no artifact is found, the check returns a Medium finding with the recommendation to investigate at the DHCP or imaging layer rather than attempting to push a per-interface registry value through standard GPO security settings (which the GPO security extension cannot express directly because the interface GUIDs are per-machine).
Recommended value
Domain-wide method exists to disable NetBIOS over TCP/IP on workstations (DHCP option 1 = 0x2, group policy preference, or imaging baseline)
Remediation
Disable NetBIOS over TCP/IP fleet-wide. Options: (1) Set DHCP scope option Microsoft Disable Netbios Option (option 1) to 0x2; (2) Group Policy Preferences > Windows Settings > Registry to push NetbiosOptions = 2 to each Tcpip_<Interface> key; (3) Bake it into the workstation imaging baseline. This setting is interface-specific and not directly addressable via standard GPO security settings.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| always-warn | WARN |
| informational | WARN |
Framework mappings
- NIST SP 800-53
- SC-8
- CIS AD Benchmark
- 6.3.2
- MITRE ATT&CK
- T1557.001