I have seen the same behavior, with some audit signatures like remote shared folder access too. The same with lsass remote BO exploit. It's not very nice to see these events, especially if there are correct IP addresses in the Windows Event Viewer generated.
Martin On 7/7/06, [EMAIL PROTECTED] < [EMAIL PROTECTED]> wrote: > > > Hi, we have SiteProtector in place and I have noticed that we are getting > alerts where the Destination AND Source IP address are identical. > These are external IP addresses and the majority of these alerts seem to > be > HTTP related? > I have checked our Firewall logs to look at the traffic, but nothing looks > suspicious. > We have a number of SiteProtector consoles in place globally, each having > multiple sensors reporting to them and each console has experienced the > same problem? > Has anybody seen this before this before? > > > ******************************************************************* > > This email and any files transmitted with it are confidential > and intended solely for the use of the individual or entity > to whom they are addressed. If you have received this > email in error please notify the sender by replying to this > email and then delete it from your system. > > No reliance may be placed upon this email without written > confirmation of its contents and any liability arising from > such reliance without written confirmation is hereby > excluded. > > Sumitomo Mitsui Banking Corporation > > ******************************************************************* > > _______________________________________________ > ISSForum mailing list > [email protected] > > TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to > https://atla-mm1.iss.net/mailman/listinfo/issforum > > To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] > > The ISSForum mailing list is hosted and managed by Internet Security > Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. > _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
