internal_tcp_4444

Explanation

The internal_tcp_4444 NDM flags connections on TCP port 4444 inside your network. Metasploit uses port 4444 by default for shell listeners that are setup after exploitation, so the use of this port could indicate successful exploitation of a remote code execution vulnerability in a running service on the source host.

What to Look For

Traffic to this port could be innocuous, particularly in cases where communications protocols dynamically assign ports. Verify that the server (the source IP in this case) is not compromised, and that it is expected to receive connections on port 4444.

Related MITRE ATT&CK Categories

Exploitation of Remote Services, Techniques T1210