Strange TCP traffic from PAN Firewall management IP going to Japan

[FR33BSD4LIFE]

Hi All,

I've noticed an strange event in our network. We have PAN 5020 and other PAN firewalls. The issue is from the management IP from one of them there is TCP traffic going to a Japanese server on port 135 (MSRPC). One of our Sensors detects it as "possible infection". Some vendors have suggested it is nothing and may be related to this since we have user agent ID enabled: https://live.paloaltonetworks.com/t5/Configuration-Articles/Unexpected-Traffic-Seen-from-the-User-ID...

But I'm not sure. Will this event warrant further exploring?

[bvandivier]

Just to err on the side of caution I recommend opening a case with our support team and uploading a tech support file from the device that is generating this behavior.  Also, any log data relevant to this traffic would be helpful as well (traffic logs, etc. if available).

Thank you.

[OtakarKlier]

Hello,

I would highly recommend you disable the user-id lookup on any untrusted/internet based zones. This can cause that type of traffic and leave the password for others to 'guess'. I would also recommend changing the user-id lookup password you use for wmi.

Regards,