CB Defense: Why Are There Multiple System Attempted To Accept Connection Events In The Defense Web Console?
search cancel

CB Defense: Why Are There Multiple System Attempted To Accept Connection Events In The Defense Web Console?

book

Article ID: 288604

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Why Are There Multiple "System Attempted To Accept (PROTOCOL/PORT) Connection From Address (IP)" Events In The CB Defense Web Console?"

Environment

  • CB Defense Web Console: All Versions
  • CB Defense Sensor: All Supported Versions
  • Microsoft Windows: All Supported Versions
  • MacOS: All Supported Versions

Resolution

These events are presented in the web console under the ATTEMPTED_SERVER TTP which indicates there was an inbound connection attempt being made to the local machine. These connection attempts could be related to incorrect / invalid credential attempts, vulnerability scans  or potentially malicious applications.

Additional Information

Incorrect / Invalid credential attempts:
  •     Review local logs and remote machine logs for access failures
  •     Use the port information to help identify likely applications
  •     Use Wireshark to view connection attempts

Vulnerability Scans:

  • These scans generally run quickly and generate a lot of connection attempts. Local firewalls and or applications may have mechanisms builtin to block or drop this activity which could cause many new connection attempts.
  • If the inbound connection IPs are on your internal network, verify whether the remote system is being used to perform vulnerability assessments, or using asset management tools.
  • If the inbound connection IPs are off of your network:
    •     Evaluate the IPs for known web based scanners: (zmap.io,  shodan.io, censys.io, wappalyzer.com, wpscans.com, quttera.com, ​sh​ad​ow​se​rv​er​.o​rg, etc.)
    •     Check local IIS / Web logs for get requests
    •     Consider creating firewall block rules based on findings

Potentially Malicious Applications:

  •     Review sensor data for local and remote systems within the CbD web console
  •     Review the Alerts page
  •     Search for interesting TTPs such as: TTP:ACTIVE_SERVER OR TTP:NON_STANDARD_PORT OR TTP:BEACON
  •     Evaluate your findings