Akamai Guardicore Segmentation CTI

Threat Information

Role	Attacker, Scanner
Services Targeted	SMB
Tags	MS17-010 SMB Null Session Login Outgoing Connection File Operation By CMD CMD PowerShell IDS - Attempted Administrator Privilege Gain Known Malware IDS - A Network Trojan was detected SMB
Associated Attack Servers	139.5.177.32 185.47.128.124 205.234.253.185

Basic Information

IP Address	60.248.154.95
Domain	-
ISP	HiNet
Country	Taiwan, Province of China
WHOIS	Created Date	-
	Updated Date	-
	Organization	-

First seen in Akamai Guardicore Segmentation	2018-12-02
Last seen in Akamai Guardicore Segmentation	2024-04-01

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

IDS detected A Network Trojan was detected : ETERNALBLUE Probe Vulnerable System Response MS17-010	IDS - A Network Trojan was detected
IDS detected Attempted Administrator Privilege Gain : Windows SMB remote code execution attempt	IDS - Attempted Administrator Privilege Gain
PowerShell session started by c:\windows\system32\windowspowershell\v1.0\powershell.exe
The machine was exploited using the ms17-010 vulnerability
Process c:\windows\system32\windowspowershell\v1.0\powershell.exe generated outgoing network traffic to: 139.5.177.32:8032 and 205.234.253.185:8888	Outgoing Connection
Connection was closed due to user inactivity

Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

Threat Information

Basic Information

Attack Flow