Gateway and Management logs

[Sajenthiran_Mic]

We use multiple checkpoint gateways ... we have times where we try to decode the logging entries.

We had recent log entries, which stated that a server has used network communication on port 1027(ICKiller).

A Windows Trojan!! https://threatwiki.checkpoint.com/threatwiki/public.htm

Now the research on the Server using an Antivirus - tool could not find any suspected infection.

According to checkpoint are the security gateways detects suspicious communication based on signature inside the packet. Is that the case even when Antivirus Blade is not active? Is the default Intrusion Detection System able accurately to identify threats

[the_rock]

I had seen this before, so my educated guess is that those threats are detected properly even when AV is not on, but I will let someone from CP give you an official statement / answer.

[Timothy_Hall]

Were these log references for port 1027 in the "source port" field?  If so you have have nothing to worry about, the ICKiller trojan used a fixed port of 1027 in the distant past.  What happened is TCP on the initiating system chose source port 1027 from the ephemeral range of 1024-65535 for a new TCP connection, and it happened to match the included service object ICKiller.  What you are seeing in the log is a simple mapping from a port number to a name, not an indicator of compromise.

[Sajenthiran_Mic]

How do we destingushe between a simple source port mapping instant and a real issue? based on the Firewall logs?

[Bob_Zimmerman]

What about the log entry led you to believe there was a problem?

Just the name in the Service field? If so, find the service object and disable "Match for Any", or delete the object. You could also disable name resolution before using the logs.

[PhoneBoy]

Not much you can ascertain based on that simple firewall log.
Threat Prevention logs may be more actionable.