Port Sweep on port 445 and 5986 from ntoskrnl.exe

NetHunt 0 Reputation points
2024-03-18T07:24:44.3+00:00

I noticed a port sweep connection by ntkrnlmp.exe. Alerts are getting generated everyday in SIEM Sentinel. We discovered an internal source IP (private) attempting to connect to numerous internal private IP addresses over port 445 and port 5986(WinRM).

_Im_NetworkSession table in sentinel capturing these logs under DeviceNeworkEvents. Initiating process is 'ntkrnlmp.exe' It's likely that some system-level processes or services are utilizing network resources, possibly for legitimate purposes like system management, updates, or communication with other systems. But not sure what is causing this issue.

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,170 questions
Windows Network
Windows Network
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.Network: A group of devices that communicate either wirelessly or via a physical connection.
653 questions