topic Re: Verification of malware events in General Topics

Verification of malware events

Vladimir — Sun, 05 Jul 2020 15:44:48 GMT

I am seeing :

but am having trouble verifying the validity of these events.

No RBLs, including IBM X-Force exchange list the resolved IP as a C&C.

Is there a way to determine how CP decided that this host belongs to the Maze C&C?

My Watchtower app is getting hammered with alarms, but the two internal hosts that are being flagged are unlikely to really be compromised.

Re: Verification of malware events

PhoneBoy — Sun, 05 Jul 2020 23:27:36 GMT

Send me the unobscured stuff out-of-band, I can ask around.

Re: Verification of malware events

_Val_ — Mon, 06 Jul 2020 08:47:28 GMT

It is right there in the logs. There is a DNS request for C&C IP address.

These hosts you are talking about, are they your internal DNS servers? If they are, the infection can be somewhere else. Start DNS logging on those servers to see which machines request DNS entries for C&C

Re: Verification of malware events

Vladimir — Mon, 06 Jul 2020 13:39:25 GMT

I know the destination and I have doubts about validity of it is being a part of the C&C.

Re: Verification of malware events

Vladimir — Mon, 06 Jul 2020 13:56:27 GMT

Just dropped you an email.

Thank you.

Re: Verification of malware events

_Val_ — Mon, 06 Jul 2020 17:27:51 GMT

In this case, raise this with TAC.

Re: Verification of malware events

Vladimir — Mon, 06 Jul 2020 18:26:44 GMT

So this ended-up a false-positive by IRT and was that way for around 24 hours.

Is there any way to address these issues in real-time?

Re: Verification of malware events

PhoneBoy — Tue, 07 Jul 2020 01:03:13 GMT

Even after we revert a given IOC, caching means it can take a few hours for the issue to resolve.
Local changes to the Threat Prevention policy can be made in the meantime and take effect when you push policy.