Glossary
LLMNR and NBT-NS poisoning
An attack where a host on the local network answers broadcast name lookups to capture NetNTLM authentication from Windows clients.
When DNS cannot resolve a name, Windows falls back to broadcast protocols: Link-Local Multicast Name Resolution (LLMNR), NetBIOS Name Service (NBT-NS) and, on recent versions, mDNS. Any machine on the same segment can answer those broadcasts. An attacker who answers "that's me" receives the client's connection attempt, often including a NetNTLMv2 authentication that can be cracked offline or relayed to another server.
The defence is to turn the fallbacks off: disable LLMNR by Group Policy, disable NetBIOS over TCP/IP through DHCP or adapter settings, block mDNS, and control WPAD. Requiring SMB and LDAP signing limits what a captured authentication can be relayed to.