NF - POLICY - LLMNR - Link-local Multicast name resolution in use - Unsafe to use

NF – POLICY – LLMNR – Link-local Multicast name resolution in use – Unsafe to use

Traffic of LLMNR was detected. LLMNR (Link-Local Multicast Name Resolution) is a protocol used in modern Windows operating systems (starting from Windows Vista and later) to resolve the names of neighboring computers on the same local network (link-local) when traditional DNS (Domain Name System) resolution fails

Categories:

Cyber Attack
Radiflow

ID Number

5019601

Signature

alert udp any any -> 224.0.0.252 5355 (msg:"NF - POLICY - LLMNR - Link-local Multicast name resolution in use - Unsafe to use"; content:"|00 00 00 01|"; reference:url,networkforensic.dk; metadata:26012020; classtype:policy-violation; sid:5019601; rev:1;)

MITRE ATT&CK Technique

Severity

Low

Recommendations/Investigative actions

If there is no use of LLMNR, it's recommended to disable the communication. If there is no option to disable, It's better to disable the rule because of a big amount of false positives