IPS log question

Question

Hi, 
 We have some nat rules in our UTM SG310. 
 Today when I was watching the IPS logs came accross this: 
 
 2019:06:07-06:57:09 securitysrv1-2 snort[18296]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="OS-WINDOWS Microsoft Windows Terminal server RDP over non-standard port attempt" group="110" srcip="185.156.177.242" dstip="10.0.10.221" proto="6" srcport="54007" dstport="18111" sid="49040" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0" 
 What I dont understand is Port 18111 is not being used for the Windows TS, but this port is beeing used to view some xml files on 10.0.10.221 
 I thought maybe someone from the source IP try to open the RDP by using port 18111 and that is why it get logged, but it was not the case. 
 So port 18111 is opened, there is application on 10.0.10.221 that us this port. Why IPS think this connection is for Windows TS and drop it? 
 Any suggestion? 
 
 Thanks

Badrobot · Accepted Answer

Could be either direct or indirect through just using RDP or through some vulnerability aspect, remember the IPS will detect the attempt & prevent it whether or not it would work on server, it does not mean the attempt would be successful even if you did not have an IPS as long as you known your system and patched/hardened/updated. This is why you have to update and patch vulnerabilities and harden your OS. There are many vulnerabilities for RDP over the years, many of these have been patched by Microsoft unless they are new or exist on a EOL OS. Hackers thrive on picking the weakest link in the bunch so they will constantly scan for open ports on public IP's, depending on how much information they can get from those scans you may see attacks closely related to you systems. Or you they can just get lucky, i.e. most companies have some Microsoft products. They then attempt various known attacks against those ports hoping they will catch a company that has not invested a lot in IT or has a lazy admin. I posted a few links below to help also inform. 
 
 Port Scanning with Nmap- https://www.networkworld.com/article/3296740/what-is-nmap-why-you-need-this-network-mapper.html 
 RDP vulnerabilities search in CVE- https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=RDP 
 Firewalking - https://www.techopedia.com/definition/26261/fire-walking