Intrusion PreventionResponder.LLMNR.Poisoning.Information.Disclosure
Description
This indicates detection of an attack attempt using Responder.
Responder is a LLMNR/NBT-NS poisoner used to capture hashes and disclose information from vulnerable Windows systems.
Affected Products
Any vulnerable Windows systems
Impact
Information Disclosure: Remote attackers can gain sensitive information from vulnerable systems
Recommended Actions
Monitor traffics from that network for any suspicious activity.
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 49485 |
| Created | Sep 09, 2020 |
| Updated | Apr 12, 2021 |
| Risk |
|
| Default Action | drop |
| Active | |
| Affected OS | Windows |
| Affected App | Other |