Detect Responder (LLMNR, NBT-NS, MDNS poisoner) with osquery

#responder #osquery #python #security

This repo contains a python-based extension for osquery to detect active instances of Responder or any NBT-NS and LLMNR spoofers/poisoners on the network.

This extension was developed using osquery’s Python bindings from https://github.com/osquery/osquery-python/

This extension was written with native Python modules to reduce the need for installing third-party Python libraries on hosts. Although it would have been cleaner and easier to use a library like Scapy, it would require installing it on every host where the extension was used.

Detect Responder