Akamai Guardicore Segmentation CTI

Threat Information

Role	Attacker, Scanner
Services Targeted	SMB
Tags	Access Suspicious Domain HTTP Known Malware SMB IDS - Attempted Administrator Privilege Gain NetBIOS Outgoing Connection MS08-067 Cookie Hijacking SMB Null Session Login Download File Turn Off DEP
Associated Attack Servers	sbcglobal.net 172.15.0.112

Basic Information

IP Address	190.131.231.187
Domain	-
ISP	-
Country	Colombia
WHOIS	Created Date	-
	Updated Date	-
	Organization	-

First seen in Akamai Guardicore Segmentation	2024-04-30
Last seen in Akamai Guardicore Segmentation	2024-09-16

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

x. was downloaded 7 times	Download File
Process netsvcs Service Group generated outgoing network traffic to: 172.15.0.112:5159	Outgoing Connection
Process netsvcs Service Group attempted to access suspicious domains: sbcglobal.net 2 times	Outgoing Connection Access Suspicious Domain
IDS detected Attempted Administrator Privilege Gain : Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (15)	IDS - Attempted Administrator Privilege Gain
IDS detected Attempted Administrator Privilege Gain : Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (25)	IDS - Attempted Administrator Privilege Gain
The machine was exploited using the ms08-067 vulnerability
Connection was closed due to user inactivity

Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

Threat Information

Basic Information

Attack Flow