Suspicious DNS Query - conficker

Reply
Highlighted
L4 Transporter

Suspicious DNS Query - conficker

Hey,

Is there a way for not letting conficker fill up the threat logs? Or an easy way to filter them out? I have 1000+ logs from 1 host on just a few hours and it is getting hard to see the other threats... Even in the ACC, I get a list full of conficker, nothing else. This is caused by every conficker URL being identified as a different threat ID.

Kind regards,

Bob

Tags (3)
L4 Transporter

Re: Suspicious DNS Query - conficker

Hi,

You can use the anti-spyware profile and add the exception for DNS queries not to be populated in the threat logs by choosing the action allow.

spyware.PNG.png

Associate the profile to the rule which the traffic is hitting.

Thanks,

Syed R Hasnain

L4 Transporter

Re: Suspicious DNS Query - conficker

So I would need to create a new rule above the one that allows it at the moment with source IP the infected clients (otherwise I would not know when other clients have it)?

Also, the conficker threat has a lot of threat ID's, so setting all DNS queries to all would make other threats not show up in the logs?

L7 Applicator

Re: Suspicious DNS Query - conficker

Hello,

Yes, you need to create a new rule above the one that allows it currently in order to apply the anti-spyware profile .

Below mentioned discussion may help you

Suspicious DNS Query - how to find source computer?

Thanks

L4 Transporter

Re: Suspicious DNS Query - conficker

Hi,

You can use individual threat IDS and add them in the exception and set the action for them as allow as shown above in the snap shot..So in this way you will not be doing for all the threats but just for some individuals not to be populated in the threat logs.

Thanks,

Syed R Hasnain

L4 Transporter

Re: Suspicious DNS Query - conficker

Using individual threat ID'is is not an option I believe, since conficker seems to have a lot of different threat ID's. I was trying to filter them out of my threat logs but after removing 20-30 of them, there were still a lot more that needed to be filtered out.

It seems there is no reasonable way to "group" the conficker threat and filter it out.

Since conficker uses a generic url and PA creates a different ID for each of them, the exception list would grow rapidly every day. I am not sure about this, but it seems logical.

L4 Transporter

Re: Suspicious DNS Query - conficker

Hmmm, sorry, but disconnecting the affected system from the network and cleaning it is what I would consider the right approach..... And as a side effect the log entries will go away....

We are talking IT security right :-) ?

L4 Transporter

Re: Suspicious DNS Query - conficker

This was indeed the first thing that came to my mind, but in our case, hosts in the guest network are not controlled by our IT team.

L4 Transporter

Re: Suspicious DNS Query - conficker

Just for clarification. You are not responsible for the guest network, but the traffic from the guest network is traversing your firewall ?

I would never allow a guest which is malware infected to use my network or traverse my firewall.

L4 Transporter

Re: Suspicious DNS Query - conficker

The traffic is in an isolated vlan which can only access the internet, not other internal subnets. A strict policy is in place to ensure this. I see no reason why this network should not be behind the main firewall.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!