Thread Info
  • State Verified Answer
  • +6 person also asked this people also asked this
  • Locked Locked
  • Replies 8 replies
  • Subscribers 15 subscribers
  • Views 8283 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ATP Alerts every 4 - 8 mins.

DaveCline

For the last three hours I have been getting ATP Alerts every 4 - mins.  The trouble is that the source IP keeps changing.  Here is an example.

 

Message........: BROWSER-IE Microsoft Edge App-v vbs command attempt

Details........: https://www.snort.org/search?query=48053

Time...........: 2020-05-12 15:07:12

Packet dropped.: yes

Priority.......: high

Classification.: Attempted User Privilege Gain IP protocol....: 6 (TCP)

 

Source IP address: 23.40.196.9 (a23-40-196-9.deploy.static.akamaitechnologies.com)

Source port: 80 (http)

Destination IP address: 192.168.15.18

Destination port: 53492

 

The internal IP is one of our domain controllers.  I have checks the logs on the DC's but don't see anything.

 

Any ideas?



This thread was automatically locked due to age.
Parents
  • +1

    Follow up to my original post.  My bad - it was not a domain controller, it was an internal web server that was being called out by IPS.  After logging into the webserver and doing a netstat for all activity on port 80 I saw that doSvc (Windows Delivery Optimization service ) was the culprit.  I then looked at Windows update and it was stuck downloading 2020-05 Cumulative Update for Windows Server 2019.  So that means either the CDN's have been compromised and the content is infected or its a false positive with the snort rule.  I have since then disabled the Delivery Optimization service.

    Seeing all the other similar posts my money is on a bad snort rule.

    Dave.

  • 0 in reply to DaveCline

    I've been getting these too from our Windows computers. It didn't really stop after turning off Delivery Optimization (maybe it was stlll trying to use it), but I downloaded the update manually (from MS) and applied it, and haven't had it since from that computer.

Reply
  • 0 in reply to DaveCline

    I've been getting these too from our Windows computers. It didn't really stop after turning off Delivery Optimization (maybe it was stlll trying to use it), but I downloaded the update manually (from MS) and applied it, and haven't had it since from that computer.

Children
No Data
Unfiltered HTML