Why Kaspersky Endpoint Security for Windows detects a PortScan attack despite blocking all network activity
Latest update: October 17, 2023
ID: 15857
Show applications and versions that this article concerns
- Kaspersky Endpoint Security 12.0.0 for Windows (version 12.0.0.465)
- Kaspersky Endpoint Security 11.11.0 for Windows (version 11.11.0.452)
- Kaspersky Endpoint Security 11.10.0 for Windows (version 11.10.0.399)
- Kaspersky Endpoint Security 11.9.0 for Windows (version 11.9.0.351)
- Kaspersky Endpoint Security 11.8.0 for Windows (version 11.8.0.384)
- Kaspersky Endpoint Security 11.7.0 for Windows (version 11.7.0.669)
- Kaspersky Endpoint Security 11.6.0 for Windows (version 11.6.0.394)
After applying the Firewall rule in Kaspersky Endpoint Security for Windows that blocks all network activity, the Network Threat Protection component may still detect a PortScan attack.
This can happen because Network Threat Protection reacts before the Firewall component, so the Administrator can find out about suspicious activity on the network anyway.
