Our NS 7.0 detects tons of MSRPC_SuspiciousEncryption events from one desktop to another.
Suspicious UUID that I see is 000001a0-0000-0000-c000-000000000046. So, my questions are: - Where can I find description of 000001a0-0000-0000-c000-000000000046 interface (now I know only that its name is ISystemActivator)? - Where is this interface used? Can it be used in Microsoft Network Printing? What for it was developed? - Can this interface be used between two workstations (not between workstation and server)? On what conditions? In which cases? Any feedback is appreciated. Thank you. --- Best regards, Sergey V. Soldatov. Information security department. tel/fax +7 495 745 89 50 tel +7 495 777 77 07 (1613) _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
