ATTACK-RESPONSES Microsoft cmd.exe banner

MoneyMovers · #1 (**permalink**) 01-28-2010, 06:23 PM

I am receiving the below Intrusion Prevention Alert message every 5 minutes or so.

-- background info --

172.20.1.1 (AstaroDevice01) is my Internet-facing ASG320
Destination IP address: 172.20.1.210 (ExhangeServer01) is my internal Exhange server

AstaroDevice01 is permitted to relay inbound e-mail to ExhangeServer01. Any idea what this message means? There are messages sitting in the Spool, quarantine, etc.

------------------------------
Message Below
------------------------------

Intrusion Prevention Alert

An intrusion has been detected. The packet has been dropped automatically.
You can toggle this rule between "drop" and "alert only" in WebAdmin.

Details about the intrusion alert:

Message........: ATTACK-RESPONSES Microsoft cmd.exe banner
Details........: http://www.snort.org/pub-bin/sigs.cgi?sid=2123
Time...........: 2010:01:28-14:11:00
Packet dropped.: yes
Priority.......: 1 (high)
Classification.: Successful Administrator Privilege Gain IP protocol....: 6 (TCP)

Source IP address: 172.20.1.1 (AstaroDevice01)
Source port: 39842

Destination IP address: 172.20.1.210 (ExhangeServer01)
Destination port: 25 (smtp)

--
HA Status : HA MASTER (node id: 1)
System Uptime : 19 days 1 hours 38 minutes
System Load : 0.40
System Version : Astaro Security Gateway Appliance 7.502

Please refer to the manual for detailed instructions.
------------------------------

Thanks!

BAlfson · #2 (**permalink**) 01-28-2010, 09:04 PM

Make sure that the Exchange server is in 'SMTP Servers' on the 'Advanced' tab of 'Network Security >> Intrusion Prevention'.

If that's already done, then try a 'Source network' exclusion for 'Internal (Address)'.

Cheers - Bob

MoneyMovers · #3 (**permalink**) 01-29-2010, 03:33 PM

Yeah, I was thinking to do that -- adding the Exchange server in 'SMTP Servers' on the 'Advanced' tab of 'Network Security >> Intrusion Prevention'. However, prior to squashing the noise, I'd like to figure out why this issue is happening.

BAlfson · #4 (**permalink**) 01-29-2010, 04:36 PM

Quote:

Yeah, I was thinking to do that -- adding the Exchange server in 'SMTP Servers' on the 'Advanced' tab of 'Network Security >> Intrusion Prevention'.

That's why the issue is occuring - you don't have IPS configured correctly! ;-)

Cheers - Bob

Billybob · #5 (**permalink**) 01-29-2010, 05:30 PM

I don't know if you have owa (outlook web access) open via astaro. The cmd.exe is a probe for the old nimda worm. Some of us old folks still remember that disaster