ipmi_scan_internal_external

Explanation

IPMI (Intelligent Platform Management Interface) is a protocol that enables remote management of servers and other network devices without relying on the device's CPU or Operating System. IPMI is known to have several security weaknesses. This NDM is designed to detect IPMI scanning that is exiting the customer's network. Outbound IPMI scanning may be indicative of an infection and an attacker using a compromised machine on the customer network to pivot further outside of the network.

What to Look For

Scans launched from your network may be an indication that your network is compromised. Investigate hosts that are the source of this sort of activity in order to make sure that it is authorized and expected, and the hosts have not been compromised. This event could false positive in a situation where Netography has not been configured with the appropriate internal network IP address ranges.

Related MITRE ATT&CK Categories

Network Service Discovery, Technique T1046 - Enterprise

Active Scanning, Technique T1595 - Enterprise