Attempted Access To Lan Via Netgear Router

Trex™ · Oct 20, 2018

Please excuse the manner in which the below post is out of context as I've copied and pasted my response from another forum as a reply to someone with similar Event Viewer errors, mainly pertaining to logs from the source: WMI. The major difference between all the posts I've read matching my keyword search is... my concerns began with router logs indicating a definite threat. I've just come to the same point of curiosity regarding some Event Viewer logs while investigating the attempts to remotely access my network.

I'm currently still trying to gather information, and can provide more than I'll be covering in this initial thread creation, but to start out... IP spoofing, DoS attacks SYN/ACK scans, and what appears to be successful commands to enable UPnP on a Netgear model that doesn't even give me the option to do... (No option for DMZ either. Yes I checked.) See below:

[UPnP set event: add_nat_rule] from source 192.168.1.2

So, before I ramble on for 5 more paragraphs, here's the reply I posted on another forum regarding Event Viewer error logs:

Trex™ said: ↑

I may be totally wrong about your particular case, Martin, but I've arrived at the same forum, same post, and the event log you shared that detail several .dll files are very similar to some I've discovered on my system... and I hate to be the bearer of potentially alarming news, but in my case, this was the result of unauthorized access to my local area network.

It began with my Netgear router, logs outright detail IP Spoofing, DoS Attacks, and eventually, "LAN Access from Remote" along with the originating IP address and timestamp. As I began looking into this, it appears attempts were made to log in impersonating an application, but what appears to be most concerning are the events detailed in the logs from the source: WMI. There are numerous entries showing 'providers' registering with the windows management instrumentation in the root of system namespaces, attempting to embed itself as a LocalSystem Account.

All of that aside for a moment, my purpose for posting this is to determine any similarities between the systems with these type of errors. Specifically, are you running Windows 10 Pro? If so, have you installed the Hyper - V features? Or, even if you don't, do you know whether or not the 'Core Isolation' protection feature (or others, now, since further Windows updates, like 'Memory Integrity').

Aside from the clear indication of attacks detailed in the log file of my router as evidence of malicious intent, I've actually considered a logical, legitimate possibility which could explain the attempts to register root namespaces as LocalSystem accounts that might make me out to look monumentally ignorant (lol). It dawned on me that maybe Hyper - V had made these attempts in an effort to create a virtual system environment. Makes sense, right? Maybe...

I'm currently looking into this further, but any input, feedback, knowledge, or advice is greatly appreciated. If I may offer a bit of advice of my own, start building a metaphorical FORT of protection around your system nowadays, with the ever-increasing technological advancements, the risk of internet connectivity is higher and higher each day. If you have any highly sensitive data stored on devices with internet connection, it would be beyond asinine to leave said data unencrypted.

Stay secure and thanks to anyone that may be able to help with my .. uhh... investigation/research.
Click to expand...

Log in or Sign up

Attempted Access To Lan Via Netgear Router

Trex™ Private First Class