Tool: NBTscan

Description

[NBTscan](https://attack.mitre.org/software/S0590) is an open source tool that has been used by state groups to conduct internal reconnaissance within a compromised network.(Citation: Debian nbtscan Nov 2019)(Citation: SecTools nbtscan June 2003)(Citation: Symantec Waterbug Jun 2019)(Citation: FireEye APT39 Jan 2019)

External References

• mitre-attack
• Debian nbtscan Nov 2019
• SecTools nbtscan June 2003
• Symantec Waterbug Jun 2019
• FireEye APT39 Jan 2019

Techniques Used by This Tool

• T1016 — System Network Configuration Discovery
• T1018 — Remote System Discovery
• T1033 — System Owner/User Discovery
• T1040 — Network Sniffing
• T1046 — Network Service Discovery

APT Groups Using This Tool

• Earth Lusca
• Turla
• APT39
• BackdoorDiplomacy
• Mustang Panda
• GALLIUM
• Threat Group-3390
• Tonto Team
• Agrius
• Lotus Blossom