Detecting Responder-like Attacks

Overview of LLMNR/NBT-NS/mDNS Poisoning

LLMNR (Link-Local Multicast Name Resolution) and NBT-NS (NetBIOS Name Service), along with mDNS (Multicast DNS), are name resolution protocols. These protocols assist in resolving local hostnames to IP addresses when DNS fails. However, these protocols lack security mechanisms, making them susceptible to spoofing and poisoning attacks.

Attack Flow:

1. A victim device sends a name resolution query due to a mistyped or unresolved hostname.

2. DNS fails to resolve this query.

3. The device uses LLMNR, NBT-NS, or mDNS to try resolving the hostname.

4. An attacker using a tool like Responder responds to the query, posing as the requested host, thus poisoning the name resolution.

Result: The attacker gains the victim’s NetNTLM hash, which can potentially be cracked or used to gain access to other systems.

Detection Opportunities for Responder Attacks

Detection is challenging, but organizations can:

1. Monitor for unusual patterns in LLMNR and NBT-NS traffic, especially increased name resolution requests.

2. Use honeypot-like techniques to detect unexpected successful resolutions for non-existent hosts.

3. Automate PowerShell-based detection scripts to log suspicious activity, such as unexpected LLMNR or NBT-NS responses.

PowerShell Logging Example:

# Setup Event Log for LLMNR detection
New-EventLog -LogName Application -Source LLMNRDetection

# Log an Event
Write-EventLog -LogName Application -Source LLMNRDetection -EventId 19001 -Message $msg -EntryType Warning

Detecting Responder-like Attacks with Splunk

Timeframe:

• Earliest: 1690290078

• Latest: 1690291207

Splunk Queries

1. Detecting LLMNR Detection Alerts

index=main earliest=1690290078 latest=1690291207 SourceName=LLMNRDetection
| table _time, ComputerName, SourceName, Message

This query searches the LLMNRDetection logs created by the PowerShell script and outputs the log time, computer name, source name, and message details.

2. Sysmon Event ID 22 for DNS Query Tracking

Sysmon Event ID 22 monitors DNS queries. By tracking queries for mistyped file shares, it’s possible to detect suspicious activity.

index=main earliest=1690290078 latest=1690291207 EventCode=22 
| table _time, Computer, user, Image, QueryName, QueryResults

Explanation:

• This query retrieves DNS query events, showing the computer, user, process image, queried hostname (QueryName), and results (QueryResults).

3. Event ID 4648 - Explicit Logons to Rogue File Shares

Event ID 4648 can help detect explicit logon attempts to attacker-controlled file shares, providing insight into credential theft attempts.

index=main earliest=1690290814 latest=1690291207 EventCode IN (4648) 
| table _time, EventCode, source, name, user, Target_Server_Name, Message
| sort 0 _time

Explanation:

• This query finds explicit logon attempts, listing details like user and target server. Sorting by _time orders the events chronologically.