Akamai Guardicore Segmentation CTI

Threat Information

Role	Attacker, Scanner
Services Targeted	RDP
Tags	Human User Password Changed RDP DNS Query Turn Off DEP Successful RDP Login User Added to Group User Created Access Share
Associated Attack Servers	accounts.google.com clients1.google.com clients4.google.com google.com ssl.gstatic.com translate.googleapis.com www.googleapis.com www.google.co.il www.google.com www.gstatic.com

Basic Information

IP Address	197.211.63.119
Domain	-
ISP	-
Country	Nigeria
WHOIS	Created Date	-
	Updated Date	-
	Organization	-

First seen in Akamai Guardicore Segmentation	2024-01-09
Last seen in Akamai Guardicore Segmentation	2024-01-09

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using RDP with the following credentials: administrator / ************* - Authentication policy: White List	Successful RDP Login
Process c:\program files\google\chrome\application\chrome.exe attempted to access domains: accounts.google.com, clients1.google.com, clients4.google.com, google.com, ssl.gstatic.com, translate.googleapis.com, www.google.co.il, www.google.com, www.googleapis.com and www.gstatic.com	DNS Query
Password for user administrator was changed to: ******************	User Password Changed
User user was created with the password ****************** and added to groups: Administrators	User Created User Added to Group
Connection was closed due to timeout

Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

Threat Information

Basic Information

Attack Flow