I'm getting thousands of hack attacks on a Windows server resulting in Security log error 4625 entries. Hackers are using random IPs, so the usual RDPguard, Syspeace, etc. tools don't work. Port 3389 is closed on the server, so I'm surprised at the continued attacks.

I'd like to figure out what local ports the attackers are connecting to for their attempts, but all the automated tools I've found only look at IP. And the default Windows server logs also only show IP and remote port, not local port.

I know I can manually look at Wireshark logs, but that's labor-intensive. I'd like to find a tool that monitors failed logins and simply corroborates them with the local port, so I know what ports to close. Ideally, this doesn't generate gigantic logs or require constant monitoring; the tool would preferably be triggered by bad logins and collect the port and service info. Any ideas?

  • 1
    Why not just put this server behind a network firewall or enable the windows firewall? Then only allow the ports that are required, based on your question it sounds like this system is external facing. – SpiderIce Oct 4 '17 at 19:59
  • Thanks - Windows Firewall is currently operational and blocking most ports. I'm trying to figure out which remaining open ports need to be closed due to the attacks. – serverfault Oct 4 '17 at 20:27
  • Why is this server directly exposed to the internet? – joeqwerty Oct 4 '17 at 23:05
  • joeqwerty - it's a web server. – serverfault Oct 4 '17 at 23:23

I think your best tool is windows itself. As you already have windows firewall enabled you can use its logging to view and monitor the traffic you want.

Event log: Details are at the bottom of this Technet https://technet.microsoft.com/en-us/library/dd421717(v=ws.10).aspx

Windows firewall log: Or you can enable logging in the windows firewall and have it dump to a file. https://www.howtogeek.com/220204/how-to-track-firewall-activity-with-the-windows-firewall-log/

Or the monitoring section under windows firewall with advanced security.

| improve this answer | |
  • Thanks SpiderIce. I appreciate the links. Yes, I have thoroughly reviewed the firewall logs. The issue is that these connections aren't currently violating any rules; hence, they aren't being logged. I don't want to increase logging scope to log all traffic because the verbosity of those logs would probably fill the available server space very quickly. That's why I'm looking for a way to monitor for local port and service of the attacks, but without having to constantly run huge logs. – serverfault Oct 4 '17 at 22:17
  • 1
    @serverfault Pfirewall.log has a limit that can be set and will show accepted and blocked traffic and will list your local ports that you want. Maybe this tool will help github.com/wokhansoft/WFN it provides more detail into the windows firewall and the connections that the server is getting but I would test it on a test machine first. – SpiderIce Oct 5 '17 at 12:40
  • Thanks again, SpiderIce. This tool is cool, and I hadn't seen it yet. I'm particularly looking for a tool that can merge (a) the bad login attempts via NTLM with (b) the local port and service details. WFN only monitors the firewall and doesn't readily join with the account login audit information. – serverfault Oct 5 '17 at 20:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.