Connection on port 3387 Event viewer says “authorized”

Question

This event shows up multiple times within a minute like it was being brute-forced, but it says "authorized". My question is: Is there anyway I can see any commands that came in from this connection? I looked through my logs and files edited on that date but didn't find anything conclusive. System will get wiped soon so anything worth looking into pre-wipe would be good for future reference. I had my VPN open to the net for temp access if anyone was wondering how they got to the port in the first place.

EDIT:

I would like to thank everyone again for the help with the rep to post the pics, you guys rock, also anyone who took the time to view the topic thank you as well.

EDIT:

Back into event viewer seeing patterns I didn't notice the first round.

Hack started at 11/28 @ 1:35 am

The TerminalServices-RemoteConnectionManager the first log shows at 5:17pm

I notice USER32 reboots the system soon after group policies stops then event viewer is stopped:

Keep looking at all the hits the computer is logging. Then a bunch of service control manager processes.

Winhttproxy runs after a couple more hits, so I checked the proxy setting:

More hits flash crashes:

Honestly, I don't know what to make of the crash, whether it was an exploit to flash or just a regular flash instability.

I will make a VHD tonight and most likely wipe the machine. If anyone sees something or has any questions or settings they'd like me to check, it would be great. This is a good learning experience so any input is welcomed.

Answer 1

Unfortunately, this is a known vulnerability. Port 3387 can be used to cause a Denial of Service attacks by running remote exploit code or by Trojans. It is a hot spot. This should be closed by default (Windows). This is a udp or tcp based communication. The protocol is known as backroomnet mainly (used by other services as well). The opened ports can be found with netstat -ano. The associated pid will be helpful to identify the process. Other logs also indicate a DoS.

Answer 2

its hard to tell exactly whats going on without seeing the traffic going over the network. my first guess would be a buffer overflow followed by some sort of executable software. If possible, run a packet capture via wireshark (free software). when you see activity again make note of the time. save the capture. Ideally, you will have the capture already running when the session starts to have a full session.

Is there some way to Private message on here? assuming this is possible, I'll give you my email address if you need some help analyzing the TCP dump. I'm always interested to see what people are up to.