Threat ID 411977850 created 2021-06-11 13:58:04 (UTC)

[LeeFrancis2]

We are investigating alerts of this DNS signature for  x1.c.lencr.org.

I'd expect that a match for a clear text string in a DNS Request that it is very unlikely this is a false detection.

However to get alerts so quickly after this signature creation, suggests we are either very unlucky or  a very common public internet resource if causing this fly-by access. Anyone else receiving this threat alert shortly after an apparent WF update.

KR,

Lee

[tehfishman]

Looks like a false positive to me, I can't see why that particular Let'sEncrypt domain is flagged as malicious.

[dlonek]

Did you happen to see additional events to x1.c.lencr.org late last evening until early this morning (12:33am ET to 1:08am ET)?  We saw them the first time during the time you posted in your original post.  

[MBlaylock]

Since the update (2021-06-11) to malware this has caused significant malware alerts. To my knowledge there hasn't been any help desk tickets that parts of the internet isn't working.... Has anyone reached out to #Unit42 for an explanation?

[tehfishman]

Yeah we got bombarded by a few thousand all at once in that timeframe, I have them set to ignore until I see any evidence to suggest that they're something I should actually be concerned about.