topic Fragroute Evasion Attack - how to find source process/application? in General Topics

Fragroute Evasion Attack - how to find source process/application?

_slv_ — Tue, 17 Jun 2014 19:28:41 GMT

Hello

Last days one of my computer started generating strange traffic that is blocked by Thread Prevention (ID35111)

I have access to this computer, but how to find and remove this program that is genrating such traffic?

Regards

Slawek

Re: Fragroute Evasion Attack - how to find source process/application?

jcostello — Wed, 18 Jun 2014 20:40:26 GMT

Slawek,

You might start by looking at the netstat output for the workstation with the source port 65409

This article will help for a Windows system - See what process is using a TCP port in Windows Server 2008 - TechRepublic

The SysInternals tools from Microsoft can also help - Windows Sysinternals: Documentation, downloads and additional resources

One issue that may arise is that modern malware tends to hide itself from the built in tools that could be used to identify it.

May your efforts be successful.

James

Re: Fragroute Evasion Attack - how to find source process/application?

_slv_ — Tue, 24 Jun 2014 19:28:47 GMT

Today I did execption in volnurability profile with pcpap option set.

In Thread log I see:

In Monitor>Packe Capture > Captured files there isn't such file.

How to save this information in .pcap format file?

How can I use this information for sending it for further analysis by other vendors?

With regards

SLawek

Re: Fragroute Evasion Attack - how to find source process/application?

kiwi — Wed, 25 Jun 2014 07:14:03 GMT

Hi slv,

To save the pcap you should use the 'Export' button provided:

In Monitor>Packet Capture > Captured files you will only find PCAP files which you have grabbed using the filters on that same page or via CLI using the 'debug dataplane packet-diag' command.

Kind regards,

-Kim.

Re: Fragroute Evasion Attack - how to find source process/application?

_slv_ — Wed, 25 Jun 2014 09:48:49 GMT

Hello Kim

oops I guess I was blind!

Thx

Slawek

Re: Fragroute Evasion Attack - how to find source process/application?

_slv_ — Tue, 01 Jul 2014 10:26:08 GMT

FYI

This traffic was generated by AmmyAdmin

Unfortunetelly PAN doesnt detect this traffic as should be. AmmyADmin is well known for PAN OS aplication, but not properly detected on 6.0.2.

Case pending for update.

Slawek