Port Sweep on port 445 and 5986 from ntoskrnl.exe

Question

Port Sweep on port 445 and 5986 from ntoskrnl.exe

Aasik Ali 0

I noticed a port sweep connection by ntkrnlmp.exe. Alerts are getting generated everyday in SIEM Sentinel. We discovered an internal source IP (private) attempting to connect to numerous internal private IP addresses over port 445 and port 5986(WinRM).

_Im_NetworkSession table in sentinel capturing these logs under DeviceNeworkEvents. Initiating process is 'ntkrnlmp.exe' It's likely that some system-level processes or services are utilizing network resources, possibly for legitimate purposes like system management, updates, or communication with other systems. But not sure what is causing this issue.

StephanG 846 Reputation points

2024-04-23T13:14:17.51+00:00

Same here - i am at the task to disconnect our servers from the internet and these IP adresses came up. Happens from both our DCs.

We have Defender for Identity installed on the DCs which might be responsible as it uses 445, 135, 137, 3389 to "get information"

You can see the process tree here:

But what is this 100.x.x.x i cannot find any information about that.

--

100er subnet is something bout NAT and stuff. So i do not bother :) Keep digging through