Advanced Threat Protection research

I have reproduced it

2022-03-18 18:53:58Advanced threat protectionmessageid="18010" log_type="ATP" log_component="IPS" log_subtype="Drop" user="" protocol="UDP" src_port="53" dst_port="60541" src_ip="10.10.200.5" dst_ip="10.10.200.20" url="clickmatters.biz" threat="C2/Generic-A" event_id="CA3D6034-486F-459F-8BDC-B75DFB7998A7" type="Standard" host_login_user="" host_process_user="" endpoint_id="" execution_path=""

Is caching the DNS traffic

200.5 is my DNS

200.20 is the endpoint

That dst_ip is your infected PC, so either your DNS is infected, or an endpoint has made that query to your DNS

Thank you! I'm pretty certain an endpoint made a DNS query.  All the logs show port 53 and the "source" is google DNS and a couple others.  I was able to reproduce it and it showed my username and ip address as source.  The problem is, I am in the middle of a domain migration and have 2 trusted domains. The firewall is only syncing with one.  This will be a challenge.

Thank you! I'm pretty certain an endpoint made a DNS query.  All the logs show port 53 and the "source" is google DNS and a couple others.  I was able to reproduce it and it showed my username and ip address as source.  The problem is, I am in the middle of a domain migration and have 2 trusted domains. The firewall is only syncing with one.  This will be a challenge.