Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 6 replies
  • Subscribers 5 subscribers
  • Views 806 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS alerts - SID 57103 - SophosUpdate.exe process

Fabio Canabarro

Hello guys,

I'm receiving a lot of IPS alerts with SID 57103 for diferent destination IPs.

2021:12:17-10:29:11 sg-alpex snort[25704]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt" group="110" srcip="2.22.80.144" dstip="10.0.0.101" proto="6" srcport="80" dstport="60832" sid="57103" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2021:12:17-10:29:25 sg-alpex snort[25704]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt" group="110" srcip="2.22.80.144" dstip="10.0.0.3" proto="6" srcport="80" dstport="4493" sid="57103" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2021:12:17-10:30:30 sg-alpex snort[25704]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt" group="110" srcip="2.22.80.144" dstip="10.0.0.101" proto="6" srcport="80" dstport="60842" sid="57103" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2021:12:17-10:30:39 sg-alpex snort[25704]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt" group="110" srcip="2.22.80.144" dstip="10.0.0.4" proto="6" srcport="80" dstport="4519" sid="57103" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2021:12:17-10:42:47 sg-alpex snort[25704]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt" group="110" srcip="2.22.80.144" dstip="10.0.0.68" proto="6" srcport="80" dstport="52597" sid="57103" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
2021:12:17-10:44:03 sg-alpex snort[25704]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt" group="110" srcip="2.22.80.144" dstip="10.0.0.68" proto="6" srcport="80" dstport="52628" sid="57103" class="Attempted User Privilege Gain" priority="1" generator="1" msgid="0"
Investigating on one of these hosts, I found via NETSTAT the connection ESTABLISHED and it's respective PID. Searching in Task Manager, I found the process with the same PID, it's the SophosUpdate.exe. All hosts of this network uses Sophos Intercept X.
I checked two other environment that also have Intercept X, one have the same alerts on the IPS. Anyone else going through this situation? I don't know if this is a false positive or something trying to impersonate Sophos Update. I found it strange to also use HTTP and not HTTPS in this communication.
I've listed below all external IP's that are generating these alerts, all listed in the name of Akamai and hosted in Brazil:
- 2.22.80.144
- 92.122.173.201
- 104.90.1.165
- 104.89.253.165
- 104.89.245.166
Thanks
Fabio


This thread was automatically locked due to age.
Parents
  • 0

    Olá Fabio and welcome to the UTM Community!

    Excellent and thorough explanation of the situation.  I think this needs to have someone look at it - probably a 2nd- or 3rd-level engineer at Sophos Support as it involves both UTM and Intercept X.  Please share with us what they conclude.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0

    Olá Fabio and welcome to the UTM Community!

    Excellent and thorough explanation of the situation.  I think this needs to have someone look at it - probably a 2nd- or 3rd-level engineer at Sophos Support as it involves both UTM and Intercept X.  Please share with us what they conclude.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
Unfiltered HTML