port_1433_scanning_internal
Explanation
This NDM is triggered when there is an internal scanning activity on port 1433. This port is commonly associated with Microsoft's SQL server and is often targeted by attackers looking for vulnerable systems to exploit.
What to Look For
To analyze the results of this NDM event, you should examine the network for any internal scanning activity on port 1433. This may indicate the presence of an attacker looking for open SQL servers to exploit. You should also check endpoint logs for any signs of infection or abnormal network activity from the Review Source IP. It is important to take immediate action to contain the threat if any suspicious behavior is detected.
Related MITRE ATT&CK Categories
Updated 13 days ago