Threat Level: green Handler on Duty: Russell Eubanks

SANS ISC: Port 3389 (tcp/udp) Attack Activity - SANS Internet Storm Center Port 3389 (tcp/udp) Attack Activity


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Loading...
[get complete service list]
Top of page
Port Information
Protocol Service Name
tcp ms-term-services MS Terminal Services
udp ms-term-services MS Terminal Services
Top IPs Scanning
TodayYesterday
49.231.174.4 (4771)49.231.174.4 (40839)
193.32.163.112 (1127)193.255.111.169 (10680)
77.247.110.31 (1018)188.42.124.84 (7007)
193.255.111.169 (971)185.164.72.217 (3892)
117.2.255.218 (893)192.3.2.154 (3517)
89.163.249.200 (576)212.129.30.216 (3048)
117.136.86.245 (462)45.81.148.27 (2934)
192.3.2.154 (337)83.97.20.195 (2701)
89.197.156.142 (254)139.162.108.129 (2629)
185.108.20.145 (254)185.200.118.47 (2455)
Port diary mentions
URL
Virus Alphabet, War!, Port 3389 Spike, WinZip Issues
MS Advisory on the Vulnerability in RDP; Port 3389; FormMail Attempts
Port 3389 terminal services scans
Increased Traffic on Port 3389
An Update on the Microsoft Windows RDP "Bluekeep" Vulnerability (CVE-2019-0708) [now with pcaps]
Top of page
User Comments
Submitted By Date
Comment
Scott Fendley 2005-07-17 03:13:54
Potential exploit of Remote Desktop Protocol on Windows Systems. Please see http://isc.sans.org/diary.php?date=2005-07-15 and http://isc.sans.org/diary.php?date=2005-07-16 for more information.
jeff bryner 2002-11-09 21:16:59
See http://www.xato.net/reference/xato-112001-01.txt for a discussion on how terminal services source ip address can be easily spoofed; so don't trust event log entries of connection attempts. Jeff.
Add a comment
Top of page
CVE Links
CVE # Description
CVE-2012-0002
CVE-2015-2373 The Remote Desktop Protocol (RDP) server service in Microsoft Windows 7 SP1, Windows 8, and Windows Server 2012 allows remote attackers to execute arbitrary code via a series of crafted packets, aka "Remote Desktop Protocol (RDP) Remote Code Execution Vulnerability."
CVE-2019-0708
Top of page