Verification of malware events

[Vladimir]

I am seeing :

but am having trouble verifying the validity of these events.

No RBLs, including IBM X-Force exchange list the resolved IP as a C&C.

Is there a way to determine how CP decided that this host belongs to the Maze C&C?

My Watchtower app is getting hammered with alarms, but the two internal hosts that are being flagged are unlikely to really be compromised.

[PhoneBoy]

Send me the unobscured stuff out-of-band, I can ask around.

[Vladimir]

Just dropped you an email.

Thank you.

[_Val_]

It is right there in the logs. There is a DNS request for C&C IP address.

These hosts you are talking about, are they your internal DNS servers? If they are, the infection can be somewhere else. Start DNS logging on those servers to see which machines request DNS entries for C&C

[Vladimir]

I know the destination and I have doubts about validity of it is being a part of the C&C.

[_Val_]

In this case, raise this with TAC.

[Vladimir]

So this ended-up a false-positive by IRT and was that way for around 24 hours.

Is there any way to address these issues in real-time?

[PhoneBoy]

Even after we revert a given IOC, caching means it can take a few hours for the issue to resolve.
Local changes to the Threat Prevention policy can be made in the meantime and take effect when you push policy.