Domain Controllers are doing DNS lookups which are showing as ATP Threat alerts and blocking C&C traffic and reporting 'C2/Generic-A'

Question

I am getting regular DNS lookups to '82.81.53.202-in-addr.arpa-nettlinx.com' on my local Domain Controllers which the ATP is blocking as a C&C . Has anyone else come across this before?

maxsecobj · Accepted Answer

find out which endpoint is actually requesting this by dropping logging onto the DNS on the DC's, usally a sign of PUP's on the end system

Domain Controllers are doing DNS lookups which are showing as ATP Threat alerts and blocking C&C traffic and reporting 'C2/Generic-A'

Submitted a Tech Support Case lately from the Support Portal?