topic Re: Avoid scanning threat vulnerabilities in General Topics

Avoid scanning threat vulnerabilities

SOC_CSG — Wed, 28 May 2014 11:49:15 GMT

Hello

I have in my firewall logs events detected as a threat of this IP:

Source IP: 84.88.91.1 Spain

From Zone: Untrust

to my web server:

Destination IP: 195.77.XX.XX

Destination Port: 80

To Zone: DMZ

Multiple Vulnerabilities Types Targeting a Single Source

Acunetix Web Vulnerability Scanner Detection

Microsoft IIS Escaped Characters Decoding Command Execution Vulnerability

HTTP Directory Traversal Vulnerabilit

Microsoft Windows win.ini access attempt

Generic HTTP Cross Site Scripting Attempt

HTTP Cross Site Scripting Attempt

Microsoft SharePoint scriptresx.ashx Cross-site Scripting Vulnerability

How can I avoid or prevent this type of vulnerability scanning? or what recommendations do you suggest me?

Thank you.

dicu

VinceM — Wed, 28 May 2014 12:36:37 GMT

Hi,

First you can activate on the security rule the DSRI which will prevent analyse on your server answer.

Or you can create a custom profile for this rule

At the end on your global profile you can disable some alert.

Hope help

mbutt — Thu, 29 May 2014 15:45:21 GMT

Here is a doc that explains on how to exempt an ip address from threat profile

You can use the above doc so it will not scan that.

Here is another useful doc regarding threat prevention.

Let us know if this helps.

Thanks

Numan