How to fix the audit failure in our web server

Question

We noticed that we are getting the following audit failure logs in our web server. The workstation is not in our network.

Can anybody help me how to isolate and prevent this from happening?

An account failed to log on.

Subject:

Security ID:        NULL SID
Account Name:       -
Account Domain:     -
Logon ID:       0x0

Logon Type:         3

Account For Which Logon Failed:

Security ID:        NULL SID
Account Name:       db2admin
Account Domain:     SAYNAMY-4BF9DFF

Failure Information:

Failure Reason:     Unknown user name or bad password.
Status:         0xc000006d
Sub Status:     0xc0000064

Process Information:

Caller Process ID:  0x0
Caller Process Name:    -

Network Information:

Workstation Name:   SAYNAMY-4BF9DFF
Source Network Address: 37.220.1.6
Source Port:        1046

Detailed Authentication Information:

Logon Process:      NtLmSsp 
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only):   -
Key Length:     0

Answer 1

It looks like you may be victim of either a targetted attack or a simple script kiddie attack. Basicly someone (SAYNAMY - 37.220.1.6) is trying to authenticate with known DB2 administrator username to your server. A RIPE search excerpt follows:

inetnum:        37.220.1.0 - 37.220.1.63
netname:        RSDEDI-OJEJMBME
descr:          Dedicated Server Hosting
country:        GB
remarks:        ABUSE REPORTS: [email protected]

Important questions:

• Are you running DB2 on the affected server?
• Can you track other requests from that IP into your network by looking at e.g. firewall logs?

If you want to FIX this issue I would simply block this IP address in the firewall and the audit failure from this IP should not arrive anymore.

To block the IP address on the servers own interface you can use windows command line like this:

netsh advfirewall firewall add rule name=[NAME HERE] dir=out interface=any 
action=block remoteip=[IP HERE]/32