Actualmente estamos configurando McAfee SIEM. Algunas reglas se han configurado utilizando la identificación de la firma. A continuación se muestra la alarma que se dispara con frecuencia:
Summary: Signature ID 'Suspicious - Remote Shell Communication with Suspicious Host - Event or Flow' (47-4000180) match found The following events were found
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Source IP = 93.116.127.108 // below is the list of source IPs
Destination IP = 135.10.194.xxx //(xxx-changes)
93.116.127.108
106.186.31.135
106.184.2.29
61.150.126.243
46.151.52.231
122.52.49.214
169.228.66.91
60.248.45.40
106.184.2.29
106.186.31.135
47.18.82.224
71.6.146.186
106.186.31.135
175.193.11.61
106.186.31.135
Source Port = 38974
Destination Port = 23
pass 1
Source User = Root (Always)
Destination User = (Blank always)
Source Geolocation=Chisinau, Chisinau, Moldova, unknown
Destination Geolocation=*****************, United States, ********
Eventcount = 1
First Event - 04/11/2016 23:19:52
Last Event - 04/11/2016 23:19:52
Message - Suspicious - Remote Shell Communication with Suspicious Host - Event or Flow
Application - telnet
Average Severity = 75
Signature ID = 47-4000180
Por favor, ayúdame a entender, ¿por qué me sale esto y qué se debe hacer para resolver el problema?