07-19-2021 05:51 AM - edited 07-19-2021 08:25 AM
Hello Tech_noob
Could you create a BIOC rule like below.
REMOTE_PORT = 5355
PROTOCOL=UDP
Network = Incoming, outgoing
5355 is LLMNR port number and as you know that, if clients cannot find/resolve a remote host in DNS, starting to LLMNR query via multicast.
So, with this BIOC rule, You can detect LLMNR queried hosts and would be helpful to understand which process is responsible for the LLMNR.
with XDR you can control Windows Host firewall and block that UDP packages but from the security perspective (host hardening), Im gonna advise to use GPO for disabling LLMNR and Netbios name resolution.
