Hello. I'm looking for more clarification. It is my understanding that an mDNS poisoning attack works like this:
- Client tries to lookup service (e.g. SMB) via DNS server, but doesn't find an entry in that DNS server.
- Client then uses mDNS to send a multicast request for who has that name.
- A tool like Responder replies that it has that name and prompts the client to authenticate
- The client sends its hashed credentials to Responder.
So if we were to disable the inbound “mDNS (UDP-In)” rule, then would this effectively stop the response in step 3? This rule appears to be targeted specifically at the svchost process and therefore wouldn't block other applications like Edge, Chrome, etc. from responding. Wouldn't it better to just block the inbound port 5353 for the domain profile?
Microsoft