0

We are seeing port scans coming from many of our company devices and scanning our internal network over the VPN. The events are not reproducible and are not regular.

Scans always follow the same pattern - ping, TCP 22,80,443,445 and UDP 65534, and several hundred host addresses are targetted for each scan.

But we cannot see the traffic in those scanning devices' Windows firewall audit logs.

Extensive analysis has shown no evidence of any other unusual behavior before or after the scans.

An analysis of the client showed no clues to the cause.

Interestingly, the Windows Firewall audit logs do log the incoming ICMP response and all other outgoing connections are logged as expected.

  • Any idea how it is technically possible to avoid the firewall audit log for such a scan, while all other traffic is still logged?
  • Further ideas where to look, or how I can find the cause of it?
Improve this question
3
  • I'd attach packet captures on the suspect devices
    – schroeder ♦
    Sep 19 at 15:51
  • I'd consider spoofed IPs. A compromised host is spoofing IPs, which is why the loal device logs are not showing the outgoing traffic: there is none.
    – schroeder ♦
    Sep 20 at 11:20
  • I have already thought of this, but we get the reports only from active vpn users (and they have dynamically assigned IPs) I also don't see any way to have a hardware infection, as the traffic is sent via the software VPN tunnel. As for traffic capture, I'm still looking for a working solution.
    – H3GE
    Sep 20 at 14:46

1 Answer 1

Reset to default
0

Trellix Rogue System Detection is the cause of the portscan...

Windows Firewall isn't seeing the traffic, because the app is sending the packets for the scan with pcap_sendpacket()... (so it's raw networking without the windows ip stack)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .