Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Vladimir
Champion
Champion

Verification of malware events

I am seeing :

Maze_DNS_CnC.png

 

but am having trouble verifying the validity of these events.

No RBLs, including IBM X-Force exchange list the resolved IP as a C&C.

Is there a way to determine how CP decided that this host belongs to the Maze C&C?

My Watchtower app is getting hammered with alarms, but the two internal hosts that are being flagged are unlikely to really be compromised.

0 Kudos
7 Replies
PhoneBoy
Admin
Admin

Send me the unobscured stuff out-of-band, I can ask around.
Vladimir
Champion
Champion

Just dropped you an email.

Thank you.

0 Kudos
_Val_
Admin
Admin

It is right there in the logs. There is a DNS request for C&C IP address.

These hosts you are talking about, are they your internal DNS servers? If they are, the infection can be somewhere else. Start DNS logging on those servers to see which machines request DNS entries for C&C

0 Kudos
Vladimir
Champion
Champion

I know the destination and I have doubts about validity of it is being a part of the C&C.

0 Kudos
_Val_
Admin
Admin

In this case, raise this with TAC.

0 Kudos
Vladimir
Champion
Champion

So this ended-up a false-positive by IRT and was that way for around 24 hours.

Is there any way to address these issues in real-time?

0 Kudos
PhoneBoy
Admin
Admin

Even after we revert a given IOC, caching means it can take a few hours for the issue to resolve.
Local changes to the Threat Prevention policy can be made in the meantime and take effect when you push policy.
0 Kudos