- Products
- Learn
- Local User Groups
- Partners
- More
Check Point Jump-Start Online Training
Now Available on CheckMates for Beginners!
Why do Hackers Love IoT Devices so Much?
Join our TechTalk on Aug 17, at 5PM CET | 11AM EST
Welcome to Maestro Masters!
Talk to Masters, Engage with Masters, Be a Maestro Master!
ZTNA Buyer’s Guide
Zero Trust essentials for your most valuable assets
The SMB Cyber Master
Boost your knowledge on Quantum Spark SMB gateways!
As YOU DESERVE THE BEST SECURITY
Upgrade to our latest GA Jumbo
CheckFlix!
All Videos In One Space
We use multiple checkpoint gateways ... we have times where we try to decode the logging entries.
We had recent log entries, which stated that a server has used network communication on port 1027(ICKiller).
A Windows Trojan!! https://threatwiki.checkpoint.com/threatwiki/public.htm
Now the research on the Server using an Antivirus - tool could not find any suspected infection.
According to checkpoint are the security gateways detects suspicious communication based on signature inside the packet. Is that the case even when Antivirus Blade is not active? Is the default Intrusion Detection System able accurately to identify threats
I had seen this before, so my educated guess is that those threats are detected properly even when AV is not on, but I will let someone from CP give you an official statement / answer.
Were these log references for port 1027 in the "source port" field? If so you have have nothing to worry about, the ICKiller trojan used a fixed port of 1027 in the distant past. What happened is TCP on the initiating system chose source port 1027 from the ephemeral range of 1024-65535 for a new TCP connection, and it happened to match the included service object ICKiller. What you are seeing in the log is a simple mapping from a port number to a name, not an indicator of compromise.
How do we destingushe between a simple source port mapping instant and a real issue? based on the Firewall logs?
What about the log entry led you to believe there was a problem?
Just the name in the Service field? If so, find the service object and disable "Match for Any", or delete the object. You could also disable name resolution before using the logs.
Not much you can ascertain based on that simple firewall log.
Threat Prevention logs may be more actionable.
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY