Permitted? History Item - should I be concerned?

[Guest]

I just looked at History and I see the following two entries from a couple
weeks ago. I do not recall "permitting" these...

Name: Unknown
Alert Level: Unknown
Action Taken: Permit
Status: Succeeded

Resources:
firewallport:
HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\2792:UDP

and

Resources:
firewallport:
HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\2793:UDP

 

[Bill Sanderson]

I don't think so, but I can't tell you precisely what is using those ports
at this point. Unknowns are definitely not necessarily bad (hmm--not a very
good way of saying that...)

They are not known to be bad.

They might be bad, or they might be good.

In practice, most unknowns that I have seen have been "good"--just drivers
or code that aren't so widely used that they make it into the "known good"
category.

Did you use an external backup device at that time?

If you are curious, and would like to investigate further, you could remove
those open ports from the firewall settings, turn on notification of actions
by unknowns in Defender Options, and then see when this recurs--and perhaps
get more information. The risk is that you will likely get alerts for other
things as well, and may not know what they are either...

 

[Guest]

I may have been backing up to an external device... I'll keep my eye on that
next time... thanks for the quick reponse and have a great day...