Multiple High/Critical Alert Detected via Port 18264 | Possible FP

[Fariq_Zaidi]

Hi ,

i would like to seek clarification clarification regarding a threat detection observed on our Palo Alto firewall, which we believe may be a false positive. During our review of the threat log, we noticed that the detection from below source and destination via port 18264 references several filenames as win.ini, fake.cgi, note.txt, jhjr60x8.kspx

These filenames do not appear to relevant in the context of the environment, as the traffic was observed between Check Point devices communicating with each other over TCP port 18264, which is believed to be used for Check Point proprietary internal services (e.g. update, synchronization, or certificate-related communication). Upon further review on the traffic under application found “incomplete”, “checkpoint-cpd” and “web-browsing”.

=======================================================

URL/Filename

win.ini

Threat/Content Name

Microsoft Windows win.ini Access Attempt Detected(30851)

YAWS Unauthenticated Remote File Disclosure Vulnerability(58618)

-------------------------------------------------------------------------

URL/Filename

fake.cgi

Threat/Content Name

Microsoft Windows win.ini Access Attempt Detected(30851)

--------------------------------------------------------------------------

URL/Filename

note.txt

Threat/Content Name

Microsoft Windows win.ini Access Attempt Detected(30851)

-----------------------------------------------------------------------

URL/Filename

jhjr60x8.kspx  

Threat/Content Name

Generic Cross-Site Scripting Vulnerability(94328)

=============================================================

Any advise?

[kiwi]

Hi @Fariq_Zaidi ,

It's highly plausible that you're looking at a false positive. Check Point devices talking to each other often looks like malicious noise to a firewall that isn't expecting those proprietary strings.

If this traffic is strictly between your management server and gateways (internal only), the risk is near zero and you could add Threat Exceptions for those IPs.

If you have enabled PCAP on your threat logs you can see exactly what the data looks like. If it's a bunch of binary/hex that just happens to have "win" in it, you have your proof.

Kind regards,