This indicates detection of an attack attempt using Responder.
Responder is a LLMNR/NBT-NS poisoner used to capture hashes and disclose information from vulnerable Windows systems.

affected-products-logoAffected Products

Any vulnerable Windows systems

Impact logoImpact

Information Disclosure: Remote attackers can gain sensitive information from vulnerable systems

recomended-action-logoRecommended Actions

Monitor traffics from that network for any suspicious activity.

Telemetry logoTelemetry


IPS (Regular DB)
IPS (Extended DB)

Version Updates

Date Version Detail
2020-10-14 16.943 Sig Added
2020-09-29 16.933 Default_action:pass:drop
2020-09-17 16.925