LLMNR Poisoning Response from Rogue Host
This rule detects a Link-Local Multicast Name Resolution (LLMNR) poisoning response from a rogue host. It specifically looks for UDP traffic on port 5355 (LLMNR) where the content contains the byte sequence '|80 00|' at a depth of 4 bytes. A threshold is applied to trigger an alert if 5 such responses are observed from the same source IP within 10 seconds, indicating potential malicious activity like credential harvesting.
Suricata
