SANS ISC: Is this traffic bAD? - SANS Internet Storm Center

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

It seems like every time I take a handler shift lately, I'm talking about an uptick of traffic on another port and I'm not breaking that trend today. This really takes me back to the early days of the Internet Storm Center when that seemed to be the main thing we talked about. This time, the port that gotmy attention is UDP port 389. This is the normal port for the Lightweight Directory Access Protocol (LDAP) which is used a great deal by Microsoft Active Directory (AD). 

You'll notice we aren't seeing an increase is sources, but they do seem to have increased the amount of scanning they are doing (both number of targets and number of reports). A quick search shows there was a vulnerability reported in March, but I haven't been able to determine if this new traffic is actually trying to exploit it or not. I haven't been able to make much sense of the traffic I've captured in my personal honeypots, yet, but plan to look more carefully later today/tomorrow. For whatever it is worth, the top three scanners are from the US, India, and Belize. I probably don't need to tell this audience, but your Active Directory/LDAP is probably not something that should be directly exposed on the internet. If anyone knows what is going on, you can comment below, or e-mail us, or use our contact form.

References:

[1] https://nvd.nist.gov/vuln/detail/CVE-2020-35518

---------------
Jim Clausing, GIAC GSE #26
jclausing --at-- isc [dot] sans (dot) edu