LLMNR Activity

LLMNR is an insecure protocol that enables LLMNR poisoning attacks. LLMNR is typically disabled. But if LLMNR is enabled and DNS servers are unavailable, a device might try to resolve a hostname by sending a broadcast query to internal devices over LLMNR. An LLMNR poisoning attack occurs when an attacker, who is listening on the network, responds to an LLMNR request and impersonates the host. If the attacker can collect user credentials during the attack, they can gain unauthorized access to a device.