"responder" llmnr detection

[mhgoff]

Pen testers LOVE to use responder. It seems to be a difficult item to detect. I currently am using something I found searching called vindicate and I have it running on my networks and I have it set to create a log when something responds...I am then using a playbook and wazuh to trigger an alert. Lots of moving parts. It would be really cool to have something like this added to the honeypot piece that I saw demonstrated and the conference last month.

[dougburks]

Interesting idea!