Description
NBTscan is a network scanning tool that enumerates NetBIOS name information on local networks, and cyberattackers abuse it to map internal environments after gaining a foothold. The tool reveals hostnames, addresses, and services that cyberattackers use to plan lateral movement and identify high value systems. Because legitimate administrators also use it, defenders should triage detections against authorized activity and watch for unexpected scanning bursts.
Stats
- First seen
- January 2022
- Last seen
- October 2026
MITRE ATT&CK techniques
5 techniques across 2 tactics.
Associated groups
Alert name variants
| Alert Name |
|---|
| Application.NbtScan.A |
| Win32.Hacktool.NbtScan |
| Win32.Network.NbtScan |