Name-resolution poisoner bait

lateral_responder_bait

Broadcasts LLMNR, NBT-NS and mDNS queries for a hostname that cannot exist. On a healthy network nothing answers; an answer means a poisoner such as Responder is running and harvesting credentials, which is a live-intrusion finding rather than a configuration one.

Severity high how bad it would be if it were real

Expected outcome Nothing should react

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.
sends traffic
Generates outbound traffic. --no-network suppresses it entirely.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1046	Network Service Discovery	Discovery	coverage statistics
T1557.001	LLMNR/NBT-NS Poisoning and SMB Relay	Lateral Movement	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other lateral movement tests

Other tests in the Lateral movement category.
Test	What it does	Severity
Remote administration service probe lateral_service_probe	Connects to the remote-administration ports of neighbouring hosts in the local /24 — SMB, RDP, WinRM, SSH, RPC and VNC — to establish whether this hos…	high
SMB share enumeration without credentials lateral_smb_null_session	Asks neighbouring hosts to list their SMB shares without supplying credentials — the null session that used to be the first step of every intrusion. N…	high
WPAD proxy discovery lateral_wpad_request	Resolves the WPAD hostname and requests wpad.dat over HTTP, the automatic-proxy discovery path that lets anyone who answers first become the man in th…	medium

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.