NBT-NS Poisoning Response Detected
This rule detects NBT-NS (NetBIOS Name Service) poisoning responses. NBT-NS poisoning is a technique used by attackers to intercept network traffic by responding to NetBIOS name queries with their own IP address, effectively redirecting traffic. The rule specifically looks for UDP traffic on port 137 (NetBIOS Name Service) destined for the home network, containing the byte sequence '|85 00|' at a depth of 4 bytes, which is indicative of a NetBIOS Name Service response. A threshold of 5 such responses within 10 seconds from the same source IP triggers the alert, aiming to reduce false positives from legitimate, but infrequent, NBT-NS responses.
Suricata
