IP Address: 206.0.168.6Malicious
IP Address: 206.0.168.6Malicious
This IP address attempted an attack on a machine in our threat sensors network
Role |
Attacker, Scanner |
Services Targeted |
MSSQL MYSQL |
Tags |
MSSQL File Operation By CMD Successful MSSQL Login PowerShell DNS Query Persistency - Print Monitors System File Modification Access Suspicious Domain CMD IDS - Attempted User Privilege Gain Service Configuration Outgoing Connection Execute MsSql Shell Command |
Associated Attack Servers |
IP Address |
206.0.168.6 |
|
Domain |
- |
|
ISP |
- |
|
Country |
India |
|
WHOIS |
Created Date |
- |
Updated Date |
- |
|
Organization |
- |
First seen in Akamai Guardicore Segmentation |
2024-02-26 |
Last seen in Akamai Guardicore Segmentation |
2024-02-26 |
What is Akamai Guardicore SegmentationAkamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More
A user logged in using MSSQL with the following credentials: sa / ******* - Authentication policy: Reached Max Attempts |
Successful MSSQL Login |
MSSQL executed 1 shell commands |
Execute MsSql Shell Command |
IDS detected Attempted User Privilege Gain : SQL sp_configure - configuration change |
IDS - Attempted User Privilege Gain |
IDS detected Attempted User Privilege Gain : xp_reg* - registry access |
IDS - Attempted User Privilege Gain |
IDS detected Attempted User Privilege Gain : xp_cmdshell - program execution |
IDS - Attempted User Privilege Gain |
System file C:\Windows\AppCompat\Programs\Amcache.hve was modified |
System File Modification |
c:\windows\temp\mssqlh.exe set the command line C:\Windows\Logs\RunDllExe.dll to run using Persistency - Print Monitors |
Persistency - Print Monitors |
Process c:\windows\system32\wscript.exe attempted to access suspicious domains: down.ftp21.cc |
DNS Query Access Suspicious Domain |
Process c:\windows\syswow64\svchost.exe attempted to access suspicious domains: wmi.362-com.com |
DNS Query Outgoing Connection Access Suspicious Domain |
Process c:\windows\syswow64\svchost.exe generated outgoing network traffic to: 211.57.200.17:53 |
Outgoing Connection |
Connection was closed due to user inactivity |
|
/usr/local/mysql/lib/plugin/LinuxUDF32.SO |
SHA256: 2789f4dbbcdeb8ebff855829c734fad4e466fdd736d441e62888b8de5bc31826 |
5696 bytes |
/usr/local/mysql/lib/plugin/zzwszv32.so |
SHA256: 681c6aa7782eb7780ea4d0745ba9dfd0c20cd363e3f2976f7e76fe13984d364d |
8128 bytes |