The remote system may be affected by ransomware that encrypts most or all of the files on a user's computer. Then, the software demands that a ransom be paid in order to have the files decrypted. This attack is related to the recent ShadowBrokers dump containing NSA weaponized software exploits.

Internet Printing Protocol (IPP) is an HTTP/S based printing protocol that supports various levels of authentication and enables secure printing within an organization. The remote host was observed advertising an IPP print server to the network via multicast DNS.

Internet Printing Protocol (IPP) is an HTTP/S based printing protocol that supports various levels of authentication and enables secure printing within an organization. The remote host was observed making an IPP request to a remote print server.

Internet Printing Protocol (IPP) is an HTTP/S based printing protocol that supports various levels of authentication and enables secure printing within an organization. The remote host was observed responding to an IPP request from another host.

When sending an email, the display name of the remote user was observed. In most cases, this identifier corresponds with the sender's full name.

Versions of Intel Active Management Technology 11.5.x and 11.6.x prior to 11.6.27.3264 are affected by a flaw that is triggered as it insecurely performs read and write operations. This may allow a remote attacker to potentially execute arbitrary code depending on the Intel software installed, or a local attacker to gain privileges in other configurations.

Versions of Intel Active Management Technology 11.0.x prior to 11.0.25.3001 are affected by a flaw that is triggered as it insecurely performs read and write operations. This may allow a remote attacker to potentially execute arbitrary code depending on the Intel software installed, or a local attacker to gain privileges in other configurations.

Versions of Intel Active Management Technology 10.x prior to 10.0.55.3000 are affected by a flaw that is triggered as it insecurely performs read and write operations. This may allow a remote attacker to potentially execute arbitrary code depending on the Intel software installed, or a local attacker to gain privileges in other configurations.

Versions of Intel Active Management Technology 9.5.x prior to 9.5.61.3012 are affected by a flaw that is triggered as it insecurely performs read and write operations. This may allow a remote attacker to potentially execute arbitrary code depending on the Intel software installed, or a local attacker to gain privileges in other configurations.

Versions of Intel Active Management Technology 9.x prior to 9.1.41.3024 are affected by a flaw that is triggered as it insecurely performs read and write operations. This may allow a remote attacker to potentially execute arbitrary code depending on the Intel software installed, or a local attacker to gain privileges in other configurations.

Versions of Intel Active Management Technology 8.x prior to 8.1.71.3608 are affected by a flaw that is triggered as it insecurely performs read and write operations. This may allow a remote attacker to potentially execute arbitrary code depending on the Intel software installed, or a local attacker to gain privileges in other configurations.

Versions of Intel Active Management Technology 7.x prior to 7.1.91.3272 are affected by a flaw that is triggered as it insecurely performs read and write operations. This may allow a remote attacker to potentially execute arbitrary code depending on the Intel software installed, or a local attacker to gain privileges in other configurations.

Traffic observed from this host indicates this is a Juniper SRX firewall.

Traffic observed from this host indicates this is a WatchGuard firewall.

Traffic observed from this host indicates this is a Dell SonicWALL firewall.

Traffic observed from this host indicates this is a LANCOM firewall.

Traffic observed from this host indicates this is a pfSense firewall.

Traffic observed from this host indicates this is a Cisco Meraki cloud-managed firewall.

Traffic observed from this host indicates this is a Huawei Quidway firewall.

Versions of Intel Active Management Technology 6.x prior to 6.2.61.3535 are affected by a flaw that is triggered as it insecurely performs read and write operations. This may allow a remote attacker to potentially execute arbitrary code depending on the Intel software installed, or a local attacker to gain privileges in other configurations.

The host is using h.225.0, a common VoIP protocol, and manufacturer information was identified from this traffic.

The host is using h.225.0, a common VoIP protocol, and a username was identified from this traffic.

The PPTP VPN Server has been identified with the following vendor information.

The PPTP VPN Server has been identified with the following hostname.

The server has been identified as offering VPN services.

The H.225 protocol is part of the H.323 family of telecommunication protocols.  NNM observed the host using the H.225 protocol for Registration, Admission and Status (RAS).

The H.225 protocol is part of the H.323 family of telecommunication protocols.  NNM observed the host using the H.225 protocol for Call Signaling (CS).

The remote host has advertised or exposed information which suggests this is a network firewall.

Traffic observed from this host indicates this is a SonicWall firewall.

Certificate information identifying a hardware firewall has been detected in network traffic.

The remote host has sent a certificate for use with a WatchGuard Firebox firewall.

The remote host has sent a certificate for use with a Fortinet Fortigate firewall.

Traffic observed from this host indicates this is a ZyXEL firewall.

Traffic observed from this host indicates this is a Juniper firewall.

Traffic observed from this host indicates this is a Cyberoam firewall.

Traffic observed from this host indicates this is a Sophos firewall.

Certificate information identifying a SonicWALL VPN Concentrator has been detected in network traffic.

The remote host has sent a certificate for use by a SonicWALL device.

Simple Service Discovery Protocol (SSDP) is a network protocol used for advertisement and discovery of network services. SSDP is the basis of Universal Plug and Play (UPnP) and is intended for use in residential or small office environments. The remote host has advertised the WLAN configuration service, which is implemented for use with wireless routers or wireless access points.

PVS has observed NIC manufacturer information within DHCP traffic from the remote host.

NNM has observed MAC address information within DHCP traffic from the remote host.

The remote host has advertised or exposed information which suggests this is a wireless access point.

The remote client and server have exchanged an SMB Tree Connect AndX Request and Response.

The remote web server is using Cloudflare, a cloud-based content delivery network (CDN) service that provides internet security services by acting as a reverse proxy for websites.

OID parsing of 1.3.6.1.2.1.1.1.5.0 (sysName)

NNM has observed hostname information within DHCP traffic from the remote host.

ID	Name	Severity
700099	Ransomware Traffic Detected (WannaCry)	critical
700096	IPP Server Detection via mDNS	info
700095	IPP Client Detection (Internet Printing Protocol)	info
700093	IPP Server Detection (Internet Printing Protocol)	info
7273	User Full Name Detection via SMTP	info
700085	Intel Active Management Technology 11.5.x / 11.6.x < 11.6.27.3264 RCE	critical
700084	Intel Active Management Technology 11.0.x < 11.0.25.3001 RCE	critical
700083	Intel Active Management Technology 10.x < 10.0.55.3000 RCE	critical
700082	Intel Active Management Technology 9.5.x < 9.5.61.3012 RCE	critical
700081	Intel Active Management Technology 9.x < 9.1.41.3024 RCE	critical
700080	Intel Active Management Technology 8.x < 8.1.71.3608 RCE	critical
700079	Intel Active Management Technology 7.x < 7.1.91.3272 RCE	critical
700078	Juniper Firewall Detection	info
700077	WatchGuard Firewall Detection	info
700076	Dell SonicWALL Firewall Detection	info
700075	LANCOM Firewall Detection	info
700074	pfSense Firewall Detection	info
700073	Cisco Meraki Firewall Detection	info
700072	Huawei Firewall Detection	info
700071	Intel Active Management Technology 6.x < 6.2.61.3535 RCE	critical
7271	h.225.0 Manufacturer Detection	info
7270	h.225.0 Username Detection	info
7269	VPN Server Vendor Detection via PPTP	info
7268	VPN Server Hostname Detection via PPTP	info
7264	VPN Server Detection via PPTP/L2TP	info
700061	H.225 RAS Application Detection	info
700060	H.225 CS Application Detection	info
7266	Network Firewall Detection	info
700050	SonicWall Firewall Detection	info
7265	Hardware Firewall Detection via TLS/SSL	info
700049	WatchGuard Firebox Certificate Detection	info
700048	Fortinet Fortigate Certificate Detection	info
700043	ZyXEL Firewall Detection	info
700042	ZyXEL Firewall Detection	info
700041	Juniper Firewall Detection	info
700040	Cyberoam Firewall Detection	info
700039	LANCOM Systems Firewall Detection	info
700038	Dell SonicWall Firewall Detection	info
700037	WatchGuard Firewall Detection	info
700036	Sophos Firewall Detection	info
7262	SonicWALL VPN Detection	info
700030	SonicWALL Certificate Detection	info
700014	Wireless Access Point Detection via SSDP	info
7259	NIC Vendor Detection via DHCP (deprecated)	info
7258	MAC Address Detection via DHCP	info
7257	Wireless Access Point Detection	info
700003	SMB Tree Connect AndX Detection	info
7256	Cloudflare Server Detection via HTTP/HTTPS	info
9977	Hostname Collection (SNMP)	info
7254	Hostname Detection via DHCP	info

Detections

Analytics

Generic Family for Nessus Network Monitor

critical

info

info

info

info

critical

critical

critical

critical

critical

critical

critical

info

info

info

info

info

info

info

critical

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info