I have seen the same behavior, with some audit signatures like remote shared
folder access too. The same with lsass remote BO exploit. It's not very nice
to see these events, especially if there are correct IP addresses in the
Windows Event Viewer generated.
Martin
On 7/7/06, russell_tompkins@gb.smbcgroup.com <
russell_tompkins@gb.smbcgroup.com> wrote:
Hi, we have SiteProtector in place and I have noticed that we are getting
alerts where the Destination AND Source IP address are identical.
These are external IP addresses and the majority of these alerts seem to
be
HTTP related?
I have checked our Firewall logs to look at the traffic, but nothing looks
suspicious.
We have a number of SiteProtector consoles in place globally, each having
multiple sensors reporting to them and each console has experienced the
same problem?
Has anybody seen this before this before?
*******************************************************************
This email and any files transmitted with it are confidential
and intended solely for the use of the individual or entity
to whom they are addressed. If you have received this
email in error please notify the sender by replying to this
email and then delete it from your system.
No reliance may be placed upon this email without written
confirmation of its contents and any liability arising from
such reliance without written confirmation is hereby
excluded.
Sumitomo Mitsui Banking Corporation
*******************************************************************
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
