Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CATEGORY OFFENSE INVESTIGATION GUIDE REV 1 Manual page 50

44 M O
ALWARE FFENSES
Step 8
Step 9
Step 10
Step 11
Step 12
Step 13
Step 14
Step 15
Step 16
has become chained to another offense. Chaining means that the target has
become an attacker of another offense. This indicates a self-propagating malware.
Note: Any remote targets associated to a malware offense may be foreign or
unknown servers that the source IP address is communicating with to receive
instructions to upload data.
View the Top 5 Categories box, which displays the various types of activities
associated to the attacker during the time of the offense.
View the Top 10 Events box, which displays the top events for this offense,
organized by severity.
View the Top 5 Annotations box, which displays the most significant correlation
tests that contributed to the overall magnitude of the offense. Annotations provide
important information, such as, which devices have contributed events to the
offense.
Double-click any event that you wish to investigate in further details and view the
Source Port field. Port 6667 is commonly used by bots as an IRC-based control
channel. Spyware commonly use ports 80 and 443.
In the offense details window, click
attacker IP address. When investigating flows, select the port or application in
question. If the traffic volume and the number of conversation pairs seem to be too
high for the user, this may indicate potential malware.
In the offense details window, click
vulnerability risk and business value.
Right-click on a targets IP address and select Information > Asset Profile, which
displays which services the targets are responding to.
Once you have determined the impact of the offense, you must either block the
source of the scan, patch or shut down services on the appropriate systems, then
take the desired action against the offense.
Once you have resolved the offense, close or hide the offense.
For more information on closing or hiding an offense, see the STRM Users Guide.
Category Offense Investigation Guide
Flows to view network flows from the
Targets, which are organized by