IPS Alert - Question

1

I have been getting an alert from the IPS.
It is always from the 91.98.84.14 to only one of my hosts.

Today I ran ss and wireshark against the source IP. The wireshark is showing the connection coming from njna.horus-it.com. Their website says (translated from German):slight_smile:

Welcome to HORUS-IT Ralph Seichter. For more than 30 years, we have successfully provided qualified services in many disciplines of computer science.

Our main topics:

  • Firewalls

  • Spam and virus protection

  • cryptography

  • Software architecture and development

  • databases

  • Configuration management

  • Release management

If you need support, we are your reliable partner.

How do I determine if this is a false positive or a real threat?

2

I forgot to include the IPS Signatures.

Signature            : ET SHELLCODE Common 0a0a0a0a Heap Spray String
and
Signature            : ET WEB_CLIENT DRIVEBY GENERIC ShellExecute in Hex No Seps
3

I received the same alerts during a Microsoft Windows update.
I ended up disabling the rule ET SHELLCODE Common 0a0a0a0a Heap Spray String in emerging-shellcode.rules.

4

If horus-it.com is reputable I was considering whitelisting the IP address. I just have no way of making a determination.

5

:thinking: Are you sure it’s njna.?

6

This address has never been flagged as malicious.

https://www.abuseipdb.com/check/91.98.84.14

1 Like
7

I have been getting a lot of these alerts on one of my firewalls. 100-200 per day for a couple of weeks now. Strangely, two other IPFires I manage have gotten zero of these even though the rule is enabled on all three. I leave it enabled “just in case” because it’s not hurting anything to do so. I am guessing if it is a rule misconfiguration, that eventually it will be fixed in a rule update and the alerts will stop on their own.

1 Like
8

You’re correct it is a typo.
I will check tomorror.

1 Like
9

I just went back through my IPS Logs and it looks like these started on December 10th for me. On that day I got 5 of these alerts. The next day, 75, then progressively more each day where it’s usually over 300 per day now. I am curious if you can tell which day you started seeing these alerts. See if there is any correlation with when I started getting them.