Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Sajenthiran_Mic
Contributor

Gateway and Management logs

We use multiple checkpoint gateways ... we have times where we try to decode the logging entries.

We had recent log entries, which stated that a server has used network communication on port 1027(ICKiller).

A Windows Trojan!! https://threatwiki.checkpoint.com/threatwiki/public.htm

Now the research on the Server using an Antivirus - tool could not find any suspected infection.

According to checkpoint are the security gateways detects suspicious communication based on signature inside the packet. Is that the case even when Antivirus Blade is not active? Is the default Intrusion Detection System able accurately to identify threats

 

0 Kudos
5 Replies
the_rock
Champion
Champion

I had seen this before, so my educated guess is that those threats are detected properly even when AV is not on, but I will let someone from CP give you an official statement / answer.

0 Kudos
Timothy_Hall
Champion
Champion

Were these log references for port 1027 in the "source port" field?  If so you have have nothing to worry about, the ICKiller trojan used a fixed port of 1027 in the distant past.  What happened is TCP on the initiating system chose source port 1027 from the ephemeral range of 1024-65535 for a new TCP connection, and it happened to match the included service object ICKiller.  What you are seeing in the log is a simple mapping from a port number to a name, not an indicator of compromise.

New 2021 IPS/AV/ABOT Immersion Self-Guided Video Series
now available at http://www.maxpowerfirewalls.com
0 Kudos
Sajenthiran_Mic
Contributor

How do we destingushe between a simple source port mapping instant and a real issue? based on the Firewall logs?

 

0 Kudos
Bob_Zimmerman
Advisor

What about the log entry led you to believe there was a problem?

Just the name in the Service field? If so, find the service object and disable "Match for Any", or delete the object. You could also disable name resolution before using the logs.

0 Kudos
PhoneBoy
Admin
Admin

Not much you can ascertain based on that simple firewall log.
Threat Prevention logs may be more actionable.

0 Kudos