The remote host is running Xbox Live and just logged into the network.

The remote host is running the Havij SQL injection tool.  Havij is a web application testing tool that allows users to automatically scan web application servers for SQL injection vulnerabilities.

The remote web server has an iFrame tag which pulls its source from another web server.

The remote server is serving pornographic materials.  

The remote host sent an email with the following attachment

The remote web server contains a 'crossdomain.xml' file.  This is a simple XML file used by Adobe's Flash Player to allow access to data that resides outside the exact web domain from which a Flash movie file originated.  

The remote web server utilizes Cascading Style Sheets (CSS)  on its pages.  Further, the web server seems to be using CSS from an external source.  This can be a risk in that script code can be embedded within the CSS which would potentially execute within the user browser. 

The remote web server utilizes JavaScript within the indicated file.

The remote web server utilizes JavaScript on its pages. The 'eval()' function evaluates JavaScript code represented as a string, and is often misused. 'eval()' is a dangerous function because it executes the code it's passed with the privileges of the caller. If you run 'eval()' with a string that could be affected by a malicious party, you may end up running malicious code on the user's machine with the permissions of your webpage or extension. Although some implementations of 'eval()' are valid, there are safer and sometimes faster alternatives for common use-cases.

The remote client is actually a LogMeIn server awaiting remote connection.  LogMeIn is an application which allows users to access their computers (work or home) from anywhere in the world via a web browser.  LogMeIn works by installing an agent on the computer that is to be access remotely.  The application then establishes a client connection to an Internet server and awaits the user to connect over the established HTTPS connection.  As such, LogMeIn has the ability to bypass firewalls and proxies.

The remote client was just observed connecting to 'whatismyip.com'.  This sort of query is often used by Botnet clients to determine their external (routable) IP address.

The remote web server utilizes JavaScript on its pages.  Further, the web server seems to be using JavaScript from an external source.

The remote client appears to be tunneling traffic over a DNS server.  There are a number of DNS tunneling clients that allow internal hosts to bypass firewall and proxy inspection. 

The remote client appears to be a server that is used to tunnel traffic.  There are a number of DNS tunneling clients that allow internal hosts to bypass firewall and proxy inspection. 

The remote client appears to be tunneling traffic over a DNS server.  There are a number of DNS tunneling clients that allow internal hosts to bypass firewall and proxy inspection.

The remote host is running HDHomerun, an application used to stream digital media.  Ensure that such applications are authorized according to existing policies.

The remote host is running a client VPN application that allows remote users to connect to the computer and use it as a tunnel into the internal network.  Hamachi works by connecting to an internet server (a 'frontend' server) from inside a firewalled network.  The connection is then held open and can be accessed by users outside the network.  Once connected to Hamachi, remote users would have the ability to access internal services as if they were directly attached to the network.

The remote host is running a client VPN application that allows remote users to connect to the computer and use it as a tunnel into the internal network.  Hamachi works by connecting to an Internet server (a 'frontend' server) from inside a firewalled network.  The connection is then held open and can be accessed by users outside the network.  Once connected to Hamachi, remote users would have the ability to access internal services as if they were directly attached to the network.

The remote host is running the Grendel web application scanner.  Grendel is an attack framework that allows users to automatically scan and fuzz web application servers. 

The remote server is running an IBM AppScan web scanner.  AppScan is a security tool that allows security staff and administrators to automate web-based attacks and exploits against web servers.

The remote host is running the Orb streaming media client.  Orb is a multimedia client that is used to stream multimedia to a variety of devices.

The remote computer is running a PC-Link client, used for receiving streaming videos, music, and pictures from a KiSS server.

The remote service is a PC-Link server, used for streaming videos, music, and pictures to a KiSS player, and this port is used by a player when searching for a PC-Link server. 

The remote service is a PC-Link server, used for streaming videos, music, and pictures to a KiSS player. 

The remote host is running Maltego, a tool commonly used for gathering intelligence about an individual, domain, phone number, and more.  

The remote host is running the Qualys network scanner.  The presence of this software indicates that a group is scanning the network for vulnerabilities.

The remote server is routing network traffic over the Tor Tunnel network.  As a TOR 'end point' router, this server accepts and processes anonymized traffic over the Tor network. 

The remote host is running Timbuktu, a remote management software.  Systems running Timbuktu can both manage and be managed remotely.  Further, the software supports tunneling, which allows a host to be accessed despite firewall policies that might attempt to block it.

The remote client is utilizing the 'proxy.org' service.  proxy.org allows users to bypass corporate measures that restrict or monitor web usage.

The remote client is scanning the network with the SIPScan VOIP vulnerability scanner.  This tool scans networks and detects vulnerable VOIP SIP phones.

NNM detected an Xbox gaming console on the local network. 

The remote host is running SQLix.  SQLix is a tool that automates the detection and exploitation of web applications that are vulnerable to SQL injection attacks.  

The remote server is running the Wikto scanner.  Wikto is a tool for scanning and testing the security of web sites. 

ID	Name	Severity
5961	Xbox Live Login Detection	info
5940	Havij SQL Injection Tool Detection	info
5877	Web Server iFrame Source Hosted on 3rd-party Server	info
5874	Web Server Pornographic Material Detected (keyword 15)	medium
5873	Web Server Pornographic Material Detected (keyword 14)	medium
5872	Web Server Pornographic Material Detected (keyword 13)	medium
5871	Web Server Pornographic Material Detected (keyword 12)	medium
5870	Web Server Pornographic Material Detected (keyword 11)	medium
5869	Web Server Pornographic Material Detected (keyword 9)	medium
5868	Web Server Pornographic Material Detected (keyword 8)	medium
5867	Web Server Pornographic Material Detected (keyword 7)	medium
5866	Web Server Pornographic Material Detected ((keyword 6)	medium
5865	Web Server Pornographic Material Detected (keyword 5)	medium
5864	Web Server Pornographic Material Detected (keyword 4)	medium
5863	Web Server Pornographic Material Detected (keyword 3)	medium
5862	Web Server Pornographic Material Detected (keyword 2)	medium
5861	Web Server Pornographic Material Detected (keyword 1)	medium
5804	Email Attachment Detection (client)	info
5801	Web Site Cross-Domain Policy File Detection	info
5800	Web Server CSS Hosted on 3rd-party Server	info
5724	JavaScript Usage on Web Server Detection	info
5723	JavaScript eval() Usage on Web Server	low
5507	LogMeIn Listening Server Detection	info
5280	whatismyip.com Client Detection	info
5278	Web Server - JavaScript Hosted on 3rd Party Server	info
4976	DNS Tunneling Client Detection (SMTP)	info
4975	DNS Tunneling Client Detection (port 25 non-tcp)	info
4972	DNS Tunneling Server Detection (HTTP)	info
4971	DNS Tunneling Server Detection (HTTP)	info
4970	DNS Tunneling Client Detection (HTTP)	info
4969	DNS Tunneling Client Detection (port 80 non-TCP)	info
4811	HDHomerun Server Detection	info
4809	Hamachi VPN Version Detection	info
4808	Hamachi VPN Detection	info
4622	Grendel Web Application Scanner Detection (deprecated)	info
4138	IBM AppScan Detection	medium
4443	Orb Client Detection	info
4428	KiSS PC-Link Client Detection	info
4427	KiSS PC-Link Server Detection (UDP)	medium
4426	KiSS PC-Link Server Detection (TCP)	info
4302	Maltego Tool Detection	info
3930	Qualys Scanner Detection	low
4212	Tor Tunnel 'End Point' Server Detection	medium
4194	Netopia Timbuktu Detection	info
4160	proxy.org Client Detection	info
3957	SIPScan VOIP Vulnerability Scanner Detection	info
3956	SIPScan VOIP Vulnerability Scanner Detection	info
3926	Xbox Console Detection	info
3914	SQLiX SQL Injection Tool Detection	medium
3909	Sensepost Wikto Detection	medium

Detections

Analytics

Policy Family for Nessus Network Monitor

info

info

info

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

info

info

info

info

low

info

info

info

info

info

info

info

info

info

info

info

info

info

medium

info

info

medium

info

info

low

medium

info

info

info

info

info

medium

medium