Forum Discussion

gd-29's avatar
gd-29
Brass Contributor
Aug 07, 2019

Azure ATP Sensor tries to connect to public IPs

After installing Azure ATP Sensor on a domain controller for testing, I see a number of failed connection attempt to external IPs (specifically our public DNS IPs) on ports 3389, 135, 137 from that d...
EliOfek's avatar
EliOfek
Icon for Microsoft rankMicrosoft
Aug 21, 2019

archedmeerkat No sure what you mean by "source on the network".

We inspect the packets and look on the source IP of the packet.
If the name appears in the packet as well we sometime use it too (we call it a "hint") and also rely on it to a degree as it can't always be trusted.

Anyway, knowing the IP alone we can't tell for sure if it's public or private or vpn etc... so we check anyway.

archedmeerkat's avatar
archedmeerkat
Copper Contributor
Aug 21, 2019

EliOfek- Thanks, this answers my questions (specifically the "hint").

 

Sorry I wasn't clear by "source on the network", was just trying to specify between the source ip and any ip/name that would be inside the packet.

 

Resources