Forum Discussion

gd-29's avatar
gd-29
Brass Contributor
Aug 07, 2019

Azure ATP Sensor tries to connect to public IPs

After installing Azure ATP Sensor on a domain controller for testing, I see a number of failed connection attempt to external IPs (specifically our public DNS IPs) on ports 3389, 135, 137 from that d...
archedmeerkat's avatar
archedmeerkat
Copper Contributor
Aug 21, 2019

EliOfek- So network name resolution is done on information in the packet, rather than what the source was on the network? Or is it a combination of both?

 

Knowing that the IP or name might be from the packet can at least assist in investigations so you don't go down the wrong rabbit hole.

EliOfek's avatar
EliOfek
Icon for Microsoft rankMicrosoft
Aug 21, 2019

archedmeerkat No sure what you mean by "source on the network".

We inspect the packets and look on the source IP of the packet.
If the name appears in the packet as well we sometime use it too (we call it a "hint") and also rely on it to a degree as it can't always be trusted.

Anyway, knowing the IP alone we can't tell for sure if it's public or private or vpn etc... so we check anyway.

  • archedmeerkat's avatar
    archedmeerkat
    Copper Contributor
    Aug 21, 2019

    EliOfek- Thanks, this answers my questions (specifically the "hint").

     

    Sorry I wasn't clear by "source on the network", was just trying to specify between the source ip and any ip/name that would be inside the packet.

     

Resources