IPS Signature Missing on SEPM Server

[STF]

Morning Everyone, we are getting some logging for the IPS signature below. I cannot find it on the SEPM server. Anyone else hit this? I would like to change it to block but cannot find it in the list of signatures.

[SID: 32329] Audit: Malicious Scan Attempt 2 attack detected but not blocked. Application path: SYSTEM

[JRL]

This is interesting as we have started getting these. Not looked into it fully, have you found anything about it?
Seems local which is it's not on the published list of attacks.

------------------------------
IT Support
------------------------------

[STF]

We opened case about it and not getting anywhere... (32070296)

Hopefully this week it moves. So far support is claiming that this is to be expected however it does not make much sense.

------------------------------
STF Consulting LLC
------------------------------

[Deborah Lane-Olson]

I've gotten several of these just this week.  Also another one: Audit: Environment Config File Download Attempt attack detected but not blocked.

This is concerning, since these are outgoing events and I'm not sure exactly what they mean.  Did you get any further info from your case with Broadcom?

------------------------------
Synergetic Office Systems| Inc.
------------------------------

[STF]

We still have the case open. It was not easy to escalate it. We had to provide a ton of logs. Maybe we can get somewhere. Will let everyone know.

------------------------------
STF Consulting LLC
------------------------------

[Phillip Enns]

You ever determine anything regarding this?  Looks like we have a system receiving these as well now