Windows – SSL 3 is still enabled after setting registry keys and rebooting Windows 2008 R2

Reboot. Changes to Schannel settings do not take effect until the system is rebooted.

Such an occurrence can always be forced from the outside; it suffices to connect and send a ClientHello message that lists only junk values as "supported cipher suites". Using Wireshark or some equivalent monitoring tool like Microsoft's Network Monitor is indeed the way to go:

• Activate HTTP-level logging on IIS.
• Fire up the monitor tool.
• Wait for the event to appear again.
• See the received ClientHello messages at the time the event was triggered.

The ClientHello messages are, by necessity, not encrypted. Thus, you can see the list of announced cipher suites, and match that against your server configuration. The network monitor tool will also show you the client IP address. If the message is part of a multi-connection attempt (e.g. client first tries to connect with some parameters, then tries again with some others) then you may see a successful connection from the same client, at which point the HTTP-level logging in IIS will tell you what software the client claims to use (this is part of the HTTP headers).

A plausible explanation is probing: if someone wants to work out what cipher suites your server supports, then it will do some connection attempts with a dwindling list of supported cipher suites; this must ultimately end up with an event like the one you show. Probing tools which do that are available as an online service; others can be downloaded.

Any Internet-facing server can expect to be probed occasionally; such is the state of things (morally deplorable, but unlikely to change in the near future). Your best bet may be to simply filter out these events from your alerting mechanism, so as to ignore them completely. They are mostly harmless anyway.