topic Malicious traffic analysis in Firewall and Security Management

Malicious traffic analysis

zsszlama — Fri, 18 Mar 2022 14:29:59 GMT

We are experiencing an interesting phenomenon at our client

In several cases, we find that suspicious traffic leaves their internal server.

Unfortunately it is not clear whether this is a response traffic that is only an event displayed by smartlog or a real malicious traffic.

Please see the attached screenshots – sensitive data was masked.

Have you ever encountered something similar? Are we really dealing with malicious traffic?

Re: Malicious traffic analysis

RS_Daniel — Fri, 18 Mar 2022 15:34:22 GMT

Hi,

On the second log card i can see service:443 dst:your IP. So i assume 194.26.74.188 is trying to connect to your ip address on port 443. On the first log when 196.26.74.188 is using source port 443 and destination port some random high tcp port, it means the same to me. As i understan, reply packet from your ip address is being dropped by your IOC feed, which is correc because AFAIK onle outgoing traffic can be blocked by this feature. HTH.

Regards