-3

I don't have any idea whats causing this event. Every two minutes I am getting 100 of these logs and its consuming my bandwidth.

MSWinEventLog: WindowsServer2012R2Standard 0 Security 2686990 Wed Mar 16 23:48:24 EDT 2016 5447 Microsoft-Windows-Security-Auditing
Unknown Unknown Information

###### Other Policy Change Events Info Audit Success A Windows Filtering Platform filter has been changed.

Subject: Security ID: NT AUTHORITY\LOCAL SERVICE Account Name: NT AUTHORITY\LOCAL SERVICE Process Information: Process ID: 1120 Provider Information: ID: {DECC16CA-3F33-4346-BE1E-8FB4AE0F3D62} Name: Microsoft Corporation Change Information: Change Type: Delete

Filter Information: ID: {D579C047-5927-49E6-BF80-FC8DC1C61275} Name: Connection Broker Service (RPC-EPMAP) Type: Not persistent Run-Time ID: 294386 Layer Information: ID: {A3B42C97-9F04-4672-B87E-CEE9C483257F} Name: ALE Receive/Accept v6 Layer Run-Time ID: 46 Callout Information: ID: {00000000-0000-0000-0000-000000000000} Name: - Additional Information: Weight: 10376540038224674816 Conditions: Condition ID: {d78e1e87-8644-4ea5-9437-d809ecefc971} Match value: Equal to Condition value: 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 .d.e.v.i.c.e.. 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k. 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 32 00 5c 00 v.o.l.u.m.e.2.. 00000030 77 00 69 00 6e 00 64 00-6f 00 77 00 73 00 5c 00 w.i.n.d.o.w.s.. 00000040 73 00 79 00 73 00 74 00-65 00 6d 00 33 00 32 00 s.y.s.t.e.m.3.2. 00000050 5c 00 74 00 73 00 73 00-64 00 69 00 73 00 2e 00 .t.s.s.d.i.s... 00000060 65 00 78 00 65 00 00 00 e.x.e... Condition ID: {af043a0a-b34d-4f86-979c-c90371af6e66} Match value: Equal to Condition value: O:SYG:SYD:(A;;CCRC;;;S-1-5-80-979556362-403687129-3954533659-2335141334-1547273080) Condition ID: {0c1ba1af-5765-453f-af22-a8f791ac775b} Match value: Equal to Condition value: 0x0251 Condition ID: {3971ef2b-623e-4f9a-8cb1-6e79b806b9a7} Match value: Equal to Condition value: 0x06 Filter Action: Permit 66957945

1) What is causing these log messages?

2) How do I prevent them from consuming bandwidth?

Last but not least, what does the number "2686990" mean in

MSWinEventLog: WindowsServer2012R2Standard 0 Security 2686990 Wed Mar 16 23:48:24 EDT 2016 5447 Microsoft-Windows-Security-Auditing

migrated from security.stackexchange.com Mar 17 '16 at 14:23

This question came from our site for information security professionals.

  • Can you Check which process is running on Process ID: 1120 from task manager? – Sravan Mar 17 '16 at 9:27
  • @saravan i cant see any process id 1120 on task manager. checked it but unable to find it – List 25 Mar 17 '16 at 10:18
  • Try Clicking Show Process from all users button which requires admin privileges – Sravan Mar 17 '16 at 10:22
  • Just checked it out again and could see MPSSVC, DPS,BFE process running under 1120 – List 25 Mar 17 '16 at 10:25
  • -1 due to obvious lack of thought. No bandwidth is used, the number is no flooding and formatting is not optional. – TomTom Mar 17 '16 at 14:59
2

What bandwidth are you referring to? Event logs do not consume bandwidth, and 100 every 2 minutes is not what I would call "flooded"1.

With your event log pasted blindly into the question the way it has been, makes it impossible to actually read. Try posting it again, but this time as code formatted, and it should maintain some semblance of readability.

The first thing you need to do is found out which process has PID 1120. This will tell you what is generating these events. Based on your comments, it appears that this might be MPSSVC, which is the Windows Firewall.

Secondly we know it's doing some sort of delete operation, triggered by a rule or filter for RPC-EPMAP (which appears to be part of the Windows RPC framework).

That's really all I can gleam from what you have posted there, as unfortunately, although I am very good at interpreting large blobs of unformatted text, this one evades my attempts.

1For what it's worth, I just had a single event log receive 60,000 events in under 60 seconds. That I consider flooded.

1

These are firewall log entries, if you are sure this is not an ongoing attack, try to disable the Firewall Option: "Other Policy Change Events".

5447 - A Windows Filtering Platform filter has been changed. TechNet: https://technet.microsoft.com/en-us/en-en/library/dd772640(v=ws.10).aspx

  • how can i make sure if this is not an attack – List 25 Mar 17 '16 at 13:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.