Advanced Threat Protection research

Check your DNS server to see who is doing those requests in the internal network. If your port 53 is not open the origin of those requests can't be external.

https://www.virustotal.com/gui/url/85d158325175bc27de588b09cdf773dbe278331b565ef18df61aec915cf96540/detection

Can you paste the full log of a single entry?

I have reproduced it

2022-03-18 18:53:58Advanced threat protectionmessageid="18010" log_type="ATP" log_component="IPS" log_subtype="Drop" user="" protocol="UDP" src_port="53" dst_port="60541" src_ip="10.10.200.5" dst_ip="10.10.200.20" url="clickmatters.biz" threat="C2/Generic-A" event_id="CA3D6034-486F-459F-8BDC-B75DFB7998A7" type="Standard" host_login_user="" host_process_user="" endpoint_id="" execution_path=""

Is caching the DNS traffic

200.5 is my DNS

200.20 is the endpoint

That dst_ip is your infected PC, so either your DNS is infected, or an endpoint has made that query to your DNS

Thank you! I'm pretty certain an endpoint made a DNS query.  All the logs show port 53 and the "source" is google DNS and a couple others.  I was able to reproduce it and it showed my username and ip address as source.  The problem is, I am in the middle of a domain migration and have 2 trusted domains. The firewall is only syncing with one.  This will be a challenge.

I am seeing the same behavior; however, this is on Sophos Intercept X (not the firewall). I had a hit on one endpoint (C2/Generic-A) and it said the beacon was clickmatters.biz. The process looks to be a legitimate Chrome update (signed by Google). Slightly puzzled.

Might want to google for malware about that domain.  For example
https://www.rapid7.com/blog/post/2021/10/28/sneaking-through-windows-infostealer-malware-masquerades-as-windows-application/