msmq_udp_scan_internal_external
Explanation
This NDM is designed to detect scanning for Microsoft Message Queuing on UDP port 1801 that is exiting the customer's network. Microsoft Message Queuing is a messaging protocol that allows applications running on different servers to communicate. Outbound scanning on UDP port 1801 may be indicative of an infection and an attacker using a compromised machine on the customer network to pivot further outside of the network.
What to Look For
Scans launched from your network may be an indication that your network is compromised. Investigate hosts that are the source of this sort of activity in order to make sure that it is authorized and expected, and the hosts have not been compromised. This event could false positive in a situation where Netography has not been configured with the appropriate internal network IP address ranges.
Related MITRE ATT&CK Categories
Updated 13 days ago