Akamai Guardicore Segmentation CTI

Threat Information

Role	Attacker, Scanner
Services Targeted	SMB
Tags	IDS - A Network Trojan was detected Outgoing Connection Known Malware PowerShell File Operation By CMD MS17-010 IDS - Attempted Administrator Privilege Gain CMD SMB SMB Null Session Login
Associated Attack Servers	139.5.177.32 185.47.128.124 205.234.253.185

Basic Information

IP Address	135.125.224.87
Domain	-
ISP	Avaya
Country	United States
WHOIS	Created Date	-
	Updated Date	-
	Organization	-

First seen in Akamai Guardicore Segmentation	2022-11-17
Last seen in Akamai Guardicore Segmentation	2024-03-23

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

IDS detected A Network Trojan was detected : ETERNALBLUE Probe Vulnerable System Response MS17-010	IDS - A Network Trojan was detected
IDS detected Attempted Administrator Privilege Gain : Windows SMB remote code execution attempt	IDS - Attempted Administrator Privilege Gain
PowerShell session started by c:\windows\system32\windowspowershell\v1.0\powershell.exe
The machine was exploited using the ms17-010 vulnerability
Process c:\windows\system32\windowspowershell\v1.0\powershell.exe generated outgoing network traffic to: 139.5.177.32:8032 and 205.234.253.185:8888	Outgoing Connection
Connection was closed due to user inactivity

Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

Threat Information

Basic Information

Attack Flow