Drop by Advanced threat protection (ATP)

Question

Hello everyone. Can you help me with this alert?

LuCar Toni · Accepted Answer

Is this server your AD Server? 
 DNS Request seems to be a client, which uses this DNS service on AD server to find this URL. 
 Most likely this is a client causing such issues.

SaschaParis · Answer

Explanation for most DNS cases....your server most likely is your DC or at least has a DNS server rule. Means your clients requesta internal server, server requesta UTM or public DNS servers. So ATP DNS triggers only on server(s) 
 Most likely there's no "infected" client in the network, but a client most likely downloaded a cryptomining script (or at least got a website with a link to download such a script from that webminepool site) during surfing some websites. 
 As it got blocked by ATP DNS and the client didn't find a miner (sophos AV is quite good detecting those) there most likely a script was linked in a website for download, and ATP blocked the DNS request. So you're most likely fine, as download was not possible (no DNS resolution, no download) 
 Hope that helps