Akamai Guardicore Segmentation CTI

Threat Information

Role	Attacker, Scanner
Services Targeted	SMB
Tags	IDS - Attempted Administrator Privilege Gain MSRPC SMB Null Session Login Known Malware Outgoing Connection IDS - A Network Trojan was detected SMB MS17-010 Listening
Associated Attack Servers	192.168.0.10

Basic Information

IP Address	188.68.84.73
Domain	-
ISP	-
Country	Russian Federation
WHOIS	Created Date	-
	Updated Date	-
	Organization	-

First seen in Akamai Guardicore Segmentation	2024-03-03
Last seen in Akamai Guardicore Segmentation	2024-03-03

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

IDS detected A Network Trojan was detected : Possible ETERNALBLUE Probe MS17-010 (MSF style)	IDS - A Network Trojan was detected
IDS detected A Network Trojan was detected : Possible ETERNALBLUE Probe MS17-010 (Generic Flags)	IDS - A Network Trojan was detected
IDS detected A Network Trojan was detected : ETERNALBLUE Probe Vulnerable System Response MS17-010	IDS - A Network Trojan was detected
IDS detected Attempted Administrator Privilege Gain : Windows SMB remote code execution attempt	IDS - Attempted Administrator Privilege Gain
Process c:\windows\system32\spoolsv.exe generated outgoing network traffic to: 192.168.0.10:4444	Outgoing Connection
The machine was exploited using the ms17-010 vulnerability
Process c:\windows\system32\spoolsv.exe started listening on ports: 49161	Listening
Connection was closed due to user inactivity

Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

Threat Information

Basic Information

Attack Flow