📣 Responder Poisoning Lure

Fake LLMNR broadcasts to catch network poisoners.

→ Explore in ATT&CK matrix (4 mappings) Deployment detail

What it is

Hosts that regularly send name-resolution queries (LLMNR and NBT-NS) for names that do not exist. Poisoning tools answer such queries to capture credentials. Because nothing legitimate should answer, any response reveals an active poisoner on the network segment.

Implementation requirements

On a few hosts per segment, run a client that periodically sends LLMNR and NBT-NS queries for host names that do not exist. Respounder is an open-source example
Any answer is the signal: nothing legitimate should resolve a non-existent name, so a responder is an active poisoner. Log the responding IP and MAC address
Optional second tripwire: after a response, authenticate to the poisoner with a decoy account, so later use of the captured credential appears on the domain controllers (4768/4771/4776)
Safety: if you send credentials, the decoy account must grant nothing and have a long random password, because the attacker may crack the captured hash. Disabling LLMNR and NBT-NS fleet-wide remains the primary control; the lure still works, because it sends its own queries
OPSEC: query names that look like real mistyped shares or servers, varied between hosts and over time
Rollback: Stop the query client on each host. Disable or delete the decoy account if credentials were sent.
Upkeep: Rotate query names over time. Quarterly test with a lab poisoner.

Technologies

NetworkWindows

ATT&CK coverage 4

Technique	Tactic	Status	Confidence	Tier
T1557 Adversary-in-the-Middle	Collection	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) A simple and effective way to detect Broadcast Name Resolution Poisoning — Inject LLMNR/NBT-NS requests for hosts that do not exist: a poisoner answers them and exposes itself. Respounder — detect Responder in your network — Open-source tool that detects Responder by broadcasting lookups for fake hostnames and flagging any answer. MITRE ATT&CK Enterprise v20.0 — T1557.001 names Responder as a procedure example for LLMNR/NBT-NS poisoning. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1557 to its Lures activity.
T1557.001 Name Resolution Poisoning and SMB Relay	Collection	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) A simple and effective way to detect Broadcast Name Resolution Poisoning — Inject LLMNR/NBT-NS requests for hosts that do not exist: a poisoner answers and exposes itself. Respounder — detect Responder in your network — Open-source tool that detects Responder by broadcasting lookups for fake hostnames. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1557.001 Name Resolution Poisoning and SMB Relay as an adversary behaviour.
T1557 Adversary-in-the-Middle	Credential Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) A simple and effective way to detect Broadcast Name Resolution Poisoning — Inject LLMNR/NBT-NS requests for hosts that do not exist: a poisoner answers them and exposes itself. Respounder — detect Responder in your network — Open-source tool that detects Responder by broadcasting lookups for fake hostnames and flagging any answer. MITRE ATT&CK Enterprise v20.0 — T1557.001 names Responder as a procedure example for LLMNR/NBT-NS poisoning. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1557 to its Lures activity.
T1557.001 Name Resolution Poisoning and SMB Relay	Credential Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) A simple and effective way to detect Broadcast Name Resolution Poisoning — Inject LLMNR/NBT-NS requests for hosts that do not exist: a poisoner answers and exposes itself. Respounder — detect Responder in your network — Open-source tool that detects Responder by broadcasting lookups for fake hostnames. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1557.001 Name Resolution Poisoning and SMB Relay as an adversary behaviour.

Evidence

A simple and effective way to detect Broadcast Name Resolution Poisoning — Walker, W., Praetorian 2021 industry
Respounder — detect Responder in your network — Code Express (open source) practitioner
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard