WWW WinNT cmd.exe Access & SQL Injection

[JEFF SPRADLING]

Hi all,

I'm getting tons of alerts for the above signatures, all targeted at one server but from different IP Addresses.  They started in Germany, and now are coming from Texas.  We've checked the server and it's not vulnerable to the attack, plus the IPS is dropping the packets and sending resets, so it's not a big concern, but I wonder WHY these attacks keep coming.

Also, I've setup several Event Filters to 'subtract' the Produce Alert Action so we'll stop getting alerts when these occur.  How can I:

1) be sure that the packets are still being dropped and resets sent to the server?

2) track these attacks if we're no longer getting alerts

Finally, is the event filter the best way to turn these alerts off?

Thanks!

[Julio Carvajal]

Hello Jeff,

1) Why dont' you run wireshark and check if you are receiving Reset packets ( That would be the easiest one)

2) You could try to tune the IPS signature to send an alert after several of this events and not just one so you dont get a bunch of alerts

3) I would say it's a great approach sr, but disabling the alert I do not like it that much, I would change the way the alerts are generated as I said on point 2

Regards