Sophos UTM9 Advanced Threat Protection have threat name "C2/Generic-A" events for AD/DNS Server

thanks a lot for your help, maybe this's false positive for bad friday~~~

For Info, the last alert I had for this was at 0925 UTC+1 , so it looks like Sophos have updated their detection.

but i saw the firewall ATP log, still have DNS server address to ext. IP records, but i can't find any malware at both AD/DNS Server....

Ok, so those IP reverse Resolve to :

Some of those are root DNS servers! So I imagine they are also False positives.

For completeness , You need to find the client(s) that are making those DNS requests.

If you are using Windows DNS you will need to enable debug logging on both of your DNS Server to log all DNS requests and responses to a txt file. Only have that enabled for as long as you need it as it can be a little resource intensive.

Once you have the logs you will need to go through them to see which client is making the request.

Hi Kenny Lau 

Could you please provide the firmware version and pattern version number from your UTM? 

You can find the firmware version from the GUI Management > Up2Date > Firmware/Pattern. 

Thanks,

Hi H_Patel:

Our UTM Firmware info as follow:

Current firmware version: 9.603-1

Current pattern version: 183325

Thanks!

Kenny Lau

Hi H_Patel & all guys:

I just see the alerts again for same case, screen capture as follow, thanks.

I check this have same problem happen today, please help me! thanks!