LLMNR

LLMNR is a Windows fallback protocol that asks the local network to resolve a hostname when DNS fails. Any machine on the subnet can answer, so an attacker running a tool like Responder can reply to these broadcasts, impersonate the requested host, and capture NTLM password hashes for cracking or relay. Because modern networks rarely need it, disabling LLMNR via Group Policy is a standard hardening step.