Spoofing Attack

Microsoft.Windows.RemoteAccess.Monitor.DA_DOSP_HEURISTIC_SPOOFING_ATTACK (UnitMonitor)

A network security component is under a spoofing attack.

Knowledge Base article:

Summary

A network security component is under a spoofing attack.

Causes

A large number of packets with bad SPIs within a short amount of time might indicate a packet spoofing attack.

Resolutions

Monitor the server for signs of a spoofing attack. If an attack is detected, apply mitigation measures to stop it.

Element properties:

TargetMicrosoft.Windows.RemoteAccess.DirectAccessServer.Class
Parent MonitorSystem.Health.SecurityState
CategoryCustom
EnabledTrue
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
Alert Auto ResolveTrue
Monitor TypeMicrosoft.Windows.RemoteAccess.Monitor.Heuristic.MonitorType
RemotableTrue
AccessibilityPublic
Alert Message
Potential Spoofing Attack

Error Description - {0}
Error Cause - {1}
Error Resolution - {2}
RunAsDefault