Intrusion Prevention

Responder.LLMNR.Poisoning.Information.Disclosure

Description

This indicates detection of an attack attempt using Responder.
Responder is a LLMNR/NBT-NS poisoner used to capture hashes and disclose information from vulnerable Windows systems.

Affected Products

Any vulnerable Windows systems

Impact

Information Disclosure: Remote attackers can gain sensitive information from vulnerable systems

Recommended Actions

Monitor traffics from that network for any suspicious activity.