All Apps and Add-ons

How to create a detection rule on the LLMNR protocol knowing that I don't have Sysmon just with the logs?

Massin
Observer

Hello,
I wanted to create a detection rule on the LLMNR protocol knowing that I don't have Sysmon just with the logs.
Can you help me please?
thank you and have a great day

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please help us help you by telling us more about the use case.

What exactly are you trying to detect?  I presume the information needed usually is supplied by sysmon - have you verified the same information is available in your logs?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Massin
Observer

I try to detect the LLMNR protocol if it is activated by a malicious user

0 Karma

richgalloway
SplunkTrust
SplunkTrust

We still need more information about the use case.  How do you determine the user is malicious?  Have you verified your logs contain the necessary information?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Massin
Observer

Thank you,
we don't have a sysmon

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...