Abnormal attack logs

[#1]

Hi TAC, Need your assist on verify the capture logs is normal or abnormal. Please refer to the attached screenshot as your reference. Noticed Muieblackcat is doing port scanning, and when we check on the attack logs but some of it shows n/a. Besides that, we found out the Source IP were NSM IP. Thanks, Wilson Wong

[ibryan]

Hello,

The 'BOT Muieblackcat activity detection' alert that NSP triggers is only to detect the occurrence of the Muieblackcat activity.  This mean the alert will show a result of n/a.  There is also a signature called 'BOT Muieblackcat traffic detected I' that has the blocking option disabled by default but has alerting enabled by default.

Please can you provide the screenshots and captures of the BOT Muieblackcat alert so we can review the detection.

Many Thanks,

Ian Bryan

Technical Support Engineer

Customer Success Group

McAfee