We are seeing port scans coming from many of our company devices and scanning our internal network over the VPN. The events are not reproducible and are not regular.
Scans always follow the same pattern - ping, TCP 22,80,443,445 and UDP 65534, and several hundred host addresses are targetted for each scan.
But we cannot see the traffic in those scanning devices' Windows firewall audit logs.
Extensive analysis has shown no evidence of any other unusual behavior before or after the scans.
An analysis of the client showed no clues to the cause.
Interestingly, the Windows Firewall audit logs do log the incoming ICMP response and all other outgoing connections are logged as expected.
- Any idea how it is technically possible to avoid the firewall audit log for such a scan, while all other traffic is still logged?
- Further ideas where to look, or how I can find the cause of it?