Advanced threat C2/Generic-A

Question

Hi We have 2 Domain Controllers that some times a day did something that produce this message, what can be??

ns2.uniregistrymarket.link 
 C2/Generic-A

ns1.uniregistrymarket.link 
 C2/Generic-A

Regards ,

NewImage · Accepted Answer

It could one of the workstations on your network is trying to do a DNS lookup for that domain. 
 1. A client is sending the DNS request to your DC, 2. then your DC is forwarding that request to an outside DNS server. 3. As that request goes over the UTM, the APT system is picking it up and flagging your DC as the source. 4. The UTM blocks that DNS request, and the DC returns response to the client that it could not resolve the name 5. The client then tries its second DNS server, your other DC, and steps 1-4 repeat. 
 We need to find that client, you can log DNS requests on your DC and find the IP issuing the request. 
 If this event is happening around the time of day your executive reports are made, the UTM could be stuck in a loop trying to resolve the IP of the APT from the day before, then throwing another APT.