Add DPI-based network rule for responder footprints detection

[cogResearch]

Summary of the Pull Request

This Sigma rule detects network-level indicators of NTLM credential theft associated with the use of the Responder tool. The rule is based on deep packet inspection (DPI) and behavioral patterns outlined in the research article https://medium.com/@hx015/responder-tool-footprints-in-ntlm-credential-theft-6f25ec7984d3

Changelog

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome @cogResearch 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

[nasbench]

Hey @cogResearch can you please provide details on how these types of logs can be collected ? We do not have support yet for this type of logs hence we would like to have a detailed explanation of how a user might start collecting this data or if any commercial tools support this.

[nasbench]

ping @cogResearch

[cogResearch]

Hello @nasbench, sorry for not replying earlier and thank you for pointing this out. We are currently reviewing this internally and will follow up with a response that addresses the missing information for the users.