Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

SafePay – LLMNR/NBT-NS Poisoning for Credential Capture

Safepay Lateral Movement Sentinel
MITRE ATT&CK
Name Resolution Poisoning and SMB Relay
Data Source
DeviceNetworkEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live ttps dataset (safepay)
What This Detects
SafePay's extensive TTP list includes LLMNR/NBT-NS poisoning (Responder-style adversary-in-the-middle) to capture NTLMv2 credential hashes on the local segment — a technique distinct from the Regsvr32/CMSTP defense-evasion chain already covered.
Query
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName has_any ("responder.py","responder.exe","inveigh.exe") or ProcessCommandLine has_any ("Responder.py","Invoke-Inveigh")
| project Timestamp, DeviceName, ProcessCommandLine, AccountName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.