Anonymous Internet access after installed Template for CitrixXenApp

[jaleun]

Recently, we've received suspicious Internet sites access (see below sites) attempts on server installed after installed the Template for Citrix XenApp. I'd like to know is it possible to eliminate it and how can I fix it. Many thanks!

23.77.208.152     akamai
203.104.131.6     NHN Japan
23.77.208.155     akamai
23.77.209.48       akamai
23.13.165.163     akamai
63.88.100.178     Verizon Business
63.88.100.192     Verizon Business
23.13.171.27       akamai
63.88.100.139     Verizon Business
63.88.100.178     EXPEDIA.COM

[jconger]

You can run the PowerShell scripts from the command line outside of Splunk to see if anything is wrong there. Also, make sure something hasn't hijacked the actual .ps1 files in

SPLUNK_HOME\etc\apps\TA-XA6x-Server\bin\powershell

You can also compare what you have to the source located at:
https://github.com/splunk/splunk-template-xenapp/tree/master/app/TA-XA6x-Server/bin/powershell

[jconger]

Where are you seeing this (as in what log or Splunk query)?

There isn't anything in the Template for XenApp that would cause this.

[jaleun]

We've seen it on the firewall log and the Internet access attempts stopped after we add the %splunkhomefolder%\etc\apps\TA-XA6x-Server\local\app.conf and with the statement "state = disabled". The Internet access attempts resume right after I change the statement to "state = enabled". And I can see the attempts are generated by Powershell.exe via port 80. Any clues? Many thanks!