andreas's profileandyPhotosBlogListsMore  |  Tools Help |
|
January 20 Additional Info how to detect a attack like Conficker to crack your user accountsAs i posted before an attack as conficker will generate a lot of events in the attacked machine security event log please take care to enable logging of failure events via policy.
An event will look like this Event Type: Failure Audit
You will get the attacker name and mayber the IP marked red above Logon Type 3 – NetworkWindows logs logon type 3 in most cases when you access a computer from elsewhere on the network. One of the most common sources of logon events with logon type 3 is connections to shared folders or printers. But other over-the-network logons are classed as logon type 3 as well such as most logons to IIS If you have Operations Manager 2007 you can use Audit Collection Services (ACS)More Infos here http://technet.microsoft.com/en-us/library/bb381258.aspx http://technet.microsoft.com/en-us/library/bb381373.aspx If you want to limit events which are writen to the ACS DB you can use Adtadmin adtAdmin.exe /SetQuery An ACS collector can use Windows Management Instrumentation (WMI) Query Language (WQL) queries as filters to limit the events that are stored in the ACS database. The /SetQuery parameter implements the filter before events are saved to the ACS database. For more information on WQL and WQL queries, see Querying with WQL at http://go.microsoft.com/fwlink/?LinkId=74151.
If you have nothing you can use free tools like Logparser 2.2 http://www.microsoft.com/technet/scriptcenter/tools/logparser/default.mspx or Eventcomb to query your security eventlogs
January 17 Detect Conficker Worm Attacker with Netmon 3.2You can detect an attacker IP with MS Netmon 3.2 from Microsoft Download Center. You made a Filter like this SMB.NTStatus.Code == 0x6d that locks all unsuccsessfull account logons to your server if you made port mirroring on your switch you can get all of them like this
In this Case 10.1.1.1 was the attackers IP. You will get a lot of this in one second on your server you can also see it in Security log with failed logon events. That means if you have a lot of these frames an attack to crack you accounts will go on. If the attacker has an account it seem than like this 21:11:57 16.01.2009 58886 781.056203 {SMB:9476, NbtSS:9469, TCP:9468, IPv4:9467} 10.1.1.1 Server SMB SMB:C; Nt Create Andx, FileName = \System32\dcegzyjp.my So when you machine get infected with an authenticated you can also to try to build a filter here to detect the attacker Andy Overview over Conficker Distribution you can find here
If You have comments please post it
|
||||||
|
|
