external_tcp_4444
Explanation
The external_tcp_4444 NDM flags connections from outside the customer network to servers on the customer network listening on TCP port 4444. Metasploit uses port 4444 by default for shell listeners that are setup after exploitation, so the use of this port could indicate successful exploitation of a remote code execution vulnerability in a running service on the source host.
What to Look For
Verify that the server (the source IP in this case) is not compromised, and that it is expected to receive connections on port 4444. While traffic to this port could be innocuous, very few networks intentionally expose this service to external hosts.
Related MITRE ATT&CK Categories
Updated 13 days ago