Today I received my first alert from AWS GuardDuty that concerns me though I'm not sure how to assess the severity.
I received what appears to be an outgoing connection (or at least an attempt) to an address in another country. However the amount of data is very small and the inbound and outbound ports on the local ftp server port.
In bytes Local port 1920 21 Out bytes Unusual 2096 21
This looks like it might be errant data but I'm not sure. I would expect inbound traffic from a successful connection to be on some random high port. I'm not sure what would cause something that looks like this unless a probe sent a malformed packet and Guard Duty "thinks" it's an outgoing connection attempt.
Is there anything I can check that would explain a finding like this and help me understand if I need to or can do anything about it?