First role as a sysadmin, sent 1 killed nmap.exe on app server. How'd it get there?

Posted by goinonbreak@reddit | sysadmin | View on Reddit | 32 comments

Ive recently been hired as a sys admin/level 1 soc. First job with this title so apologies ahead of time. Sent 1 sent me an alert saying an nmap.exe was detected and killed on a windows 16 RDS APP server with no outside internet access. It showed the folder being buried in a old digicert folder. Most of whats currently in this infrastructure was put there by the infrastructure engineer and my predecessor. We've moved alot of our stuff to new windows 25 server. With this one being classified as an "old RDS server" Sent 1 killed it, folder removed. Going through more stuff tomorrow to make sure its clean.This server doesnt have much on it but a small production app thats not used often. (Ill find out whats on it more tomorrow) I've been focusing alot of my knowledge and training on the servers hosting the critical important things, 3 out of the 4 Hyper Vs, backups, and level 1 soc analyst things. usually employees trying to download something or dns filter things. what are your thoughts as to how it got there? If it helps you do need 2fa to log in and only 4 people have those creds. Unlikely one of them for a number of reasons. The other variable is ive recently been trying to play around with tenable nessus pro and was doing a vulnerability scan on 2 /24 networks and a /16 . Im sure im missing alot of key details but thats the gist of it. Just curious if it was indeed a threat, I looked at search bar and nessus doesnt use nmap for network enumeration so unlikely that and more of an odd coincidence. Did someone really get access to the server and attempt to run namp? Share your wisdom oh wise ones! Thanks in advanced. Edit: grammar spelling and everything else. Im an ape on mobile.

Reply to Post

32 Comments

[-]

BlackV@reddit

> What are your thoughts as to how it got there? literally infinite number of ways, but likely a user (with permissions) what security software is on there? what logging do you have? what permissions ? what internet access ? now that you've deleted it you no longer can find the owner, which might have helped ditto for creation date (i.e. its actually been sitting ther for 10 years, no one noticed)

[-]

goinonbreak@reddit (OP)

Sent 1 mostly but ninja is also on there. Most of our logging is run through those 2 as well as our regular logs. Said it earlier to someone else but this is just another new experience for me so hearing everyone's input has been eye opening. No internet access and I find out about permissions . This has been kind of an abandoned server other than updates backup and reboots. It was there from our predecessors which may just of been the culprit where it was on there and sent 1 is just now getting around to getting it off .

[-]

BlackV@reddit

Ah, well time to turn it off :)

[-]

goinonbreak@reddit (OP)

Best advice ao far! Lol

[-]

unexpectedbbq@reddit

Word pasta would benefit from some line breaks. Someone probably installed this as a troubleshooting tool at some point

[-]

goinonbreak@reddit (OP)

Whoops sorry.. I went over it again and again to make sure it was readable and forgot .

[-]

BulletRisen@reddit

Just get AI to summarise man

[-]

jcpham@reddit

Try a third time

[-]

I-Love-IT-MSP@reddit

Odds are its been there for a long time but servers should be monitored for application installation with critical alert if something is installed. So fix that but rds apps servers are great for lateral movement and S1 is shit at detecting lateral movement. Good luck. It's either nothing or you have a threat actor with foothold on the network.

[-]

goinonbreak@reddit (OP)

Good catch. Don't think we have critical alerts for app installs. I installed windirstat on another one and no alert. Thank you.

[-]

Logical_Destruction@reddit

Some assets management tools use it for discovery too.

[-]

goinonbreak@reddit (OP)

Theres a bunch of logs in event viewer for windows assest manager possibly related?

[-]

Logical_Destruction@reddit

So a few things you might try. Go to add/remove prigrams see what's installed. Do some research on the application and see if any use nmap. Do the same thing with services, see what else is installed, build a list do some research. Last option, least likely but might tell you something. Some apps once uninstalled leave behind empty folders. You can dig around in program files both versions and appdata in different user profiles and try to chase down what might have used it. AI like chatgpt are handy for a quick review using powershell to print out a list and asking what each is used for and if they might us nmap. Good luck.

[-]

goinonbreak@reddit (OP)

Thank you

[-]

KanashimiRensei@reddit

S1 should have storyline events available. Was this a static detection or did this trigger because it ran the executable? The info there should give you enough of a lead to do additional investigation manually via logs or if you have a SIEM to correlate events. Seeing as how you're in a split role and mentioned level 1 SOC, do you have seniors you can rely on not to resolve this particular incident per say, but mentor you and guide you with a playbook of what SOC Analysts are supposed to do at different levels? and maybe reference for S1 along with basic threat hunting. It seems like you don't have a good grasp on the infrastructure yet or have a structured way of approaching alerts/incidents. Which is fine because like you said, you were recently hired...but something that should be worked on depending on your company's needs. \--- A trend is that S1 is starting to detect and evaluate freeware tools that are otherwise benign as malicious. They're useful tools for administration, but also great for reconnaissance after establishing initial footholds as part of malware campaigns.

[-]

goinonbreak@reddit (OP)

I hadn't really thought about checking thst aspect of sent 1. I was pretty focused on the server. Someone else said a similar thing about S1 recently starting to detect things lile this. And to your point about a better understanding ots something ive been doing since I started. I get alot of interactions with it but hasnt really gotten to this level yet so just at a new aspect of the role. But this will def help increase my understanding. Thanks

[-]

b-lusk@reddit

Check the file timestamps and any logs around when it was created. Could've been leftover from some old assessment/audit, or maybe a vendor had access at some point. Also worth looking at what account actually created/ran it... Event Viewer might have something useful there. The DigiCert folder location is weird though, almost like someone was trying to hide it in plain sight. If you're running Nessus scans, make sure you're documenting what you're doing and when. Last thing you want is to trigger alerts and then question if it was you or an actual threat.

[-]

reegz@reddit

nmap has legit uses, if you don’t have alerts or anything from port scanning on that machine it’s likely left over from something else. Heck even a prior pentest.

[-]

Sensitive_Scar_1800@reddit

A server administrator installed it, probably for troubleshooting. It can a great way to determine open ports. I’d check for the presence of an NPCAP driver, running nmap processes, and/or scheduled tasks that call nmap. If you want to go a little deeper, run PROCMON and/or process explorer to see what’s going on “under the hood” But if you don’t see anything, I’d chalk it up to an administrator not cleaning up after themselves.

[-]

goinonbreak@reddit (OP)

Ill try these tomorrow. Good point on the tasks scheduler

[-]

abuhd@reddit

do you send your server logs to a siem? Could check the logs and find out when if you have a time frame from when it ran.

[-]

goinonbreak@reddit (OP)

No we dont.. I heard as great of a tool it is its a whole other full time job monitoring and going through it . Think it's worth doing especially for times like this

[-]

BarracudaDefiant4702@reddit

How long it's been there? What's you oldest backup, and was it there? Lots of reasons why it could have been put there long ago as it's an old RDS server.

[-]

goinonbreak@reddit (OP)

Ooo good point. Im gonna check the older checkpoints/backups. Someone said sent 1 recently started cracking down on removing it. Thanks

[-]

Keensworth@reddit

Someone installed it

[-]

goinonbreak@reddit (OP)

Thats my guess. But how would they've gotten access to it? I saw some nmap search results about being able to run it from powershell. Would they need access to that specific server or was it a throw shit at the wall see what sticks type of thing?

[-]

raip@reddit

As others have pointed out - I wouldn't worry about it. nmap isn't malicious and it was likely installed by someone who actual had access for some troubleshooting effort.

[-]

Fuzilumpkinz@reddit

I wouldn’t over think this. S1 recently started removing nmap aggressively. This was probably installed for years. Now if you were the sole admin of this machine I would say something else. I just know we recently had to deal with the change.

[-]

goinonbreak@reddit (OP)

Very good point. Thanks

[-]

BirdsHaveUglyFeet@reddit

Network team didn't clean up after themselves?

[-]

goinonbreak@reddit (OP)

Thats not a bad guess because we do have MGB that handle alot of the bigger networking and offsite backup but why try to bury it in a subfolder

[-]

Darkhexical@reddit

Someone remoted in was in the folder and dragged it in. Not that complicated really.