What means "Blacklist DNS reverse response searching for known malware domain spheral.ru - Win.Trojan.Glupteba (1:31600)"?

I have a Cisco ASA5516x w / firepower with an IPS license installed and I'm trying to determine what means this Impact 1 alert:

Reverse DNS BLACK list response searching for known malware domain spheral.ru - Win.Trojan.Glupteba (1:31600)

The source looks like it's coming from DNS servers on the internet:

208.67.220.220

208.67.222.222

4.2.2.6

204.117.214.10

The destination is our domain controllers that are configured to be our DNS servers. I'm just trying to understand what really means this alert? The classification is "a network Trojan has been detected", but this means that a user attempted to solve an to a site that has been reported as malicious DNS record, or they have malicious software on their PC that is trying to connect to a server command & control out in the wild? To be clear, the penetration of these alerts are outside interface and evacuation is our inside interface. If someone can provide a clear explanation for these alerts, it would be greatly appreciated. Thank you!

Hello

This does not necessarily mean that the PC or the DC are infected. This rule is for a reverse DNS lookup.

With the source and the destination, it could just be a package that is the reverse DNS lookup query response. Now, why this request is sent in the first place is a question and a value of the investigation.

flow: to_client; content: "|" 07. spheral | 02. ru | 00 | » ; fast_pattern: only;

Download the capture of packages in the case of the rule, you can check and verify the IP address that is resolved to spheral.ru and then identify what PC initiated the request.

Sometimes, it could be an AV product or security, try to reverse search DNS for an IP address of the suspect.

Rate if helps.

Yogesh

Tags: Cisco Security

Similar Questions

  • What is a * successful * way to search for files containing a specific word that is not the file name?

    I've seen several threads on forum Windows 7, but no successful response.  I desperately need to find documents that contain a certain word * in * the file is not part of the file name.  It was easy under Windows XP, but it seems that they removed this feature in Windows 7, and it's really causing me problems.

    So let's say the word is 'author '... I need to find all files that contain this word, even if "author" is not in the name of the file.  I've seen different "fixes" posted by MS Tech support, but none of them work.  I tried "contains:", search filters, checking the box "always search file names and content" and nothing works, even if I saved at least a dozen documents that contain that Word.  And no, I'm not he shell.  I checked and I found at least one of them just by hunting around.  I also tried the uppercase and lowercase without result.  I would like to avoid having to download the 3rd party software.

    Please help, there must be a way!

    There is also the alternative prompt BACK, requiring no download:

    Looking for content regardless of the type of file: http://www.computerhope.com/findstr.htm

    If you have never done stuff with a DOS command prompt before, then there is some learning to navigate a file system to see well.

    (Try you the term "content:" and not "contains:" right?)

  • What color space are color presets search for?

    I noticed that if I convert the same image to multiple color spaces and apply a LUT 3D with the new adjustment to color search, the result is significantly different.  Experimentation, it seems that lookup tables work on any RGB value is given to them in any color space.  Is there a certain color space, so they have been optimized?  For example, a certain color space would give me a glance 2-strip more authentic than another due to space, in that they were sampled?  And if I create my own 3D LUTs, should I create a separate for each color space in order to get a consistent look in all areas?

    3DLUTs don't know about image encodings or spaces of colors - they operate on values.

    Devicelink profiles are similar.

    But abstract profiles are completely color management.

    Yes, you will need to create 3DLUTs for each color space and image coding to get accurate results.

  • What is the best way to search for a Datagrid?

    I want to search the installer for a datagrid control.  I did a lot of research but could not come up with a solution of single column.  Can someone give some recommendations on how I can get all the data that is in the datagrid?

    Thank you.

    Dave

    DataProvider of the DataGrid control is always an instance of ICollectionView: ArrayCollection or XMLListColection collection.

    ICollectionView's filterFunction function that would make reference to a function with a signature of the individual:

    private function filter(item:Object): Boolean {}

    }

    When you have assinged this function to the collection of table and do a refresh() on this function to call for each element in the underlying dataProvider. The "item" is current object, the line if you want, in your dataProvider for which this method is called. Now that you have the complete object available you all it's available properties; make all checks you need and return true if you want to keep the line in the filtered list of false otherwise. That's all!

    Flex Builder Help has many examples of such FilterFunction, like google!

    Good luck!

    ATTA

  • Is there a place I can go to to search for known issues with the applications made with DPS and the iPhone 6?

    I was wondering if there is a post or a site that lists known issues with products and applications on the iPhone 6.

    There was an application made, and for 3 devices that they all have the same problem where sometimes the app is fully loaded on the iphone 6.

    We tried to republish the content. Discovered that the problem is more than likely a connection slow or weak. I meant also more info on if there is a list of some sort with the known problems with some devices. Thank you much.

  • Windows could not search for new updates after the troubleshooting and repair of updates

    My computer Windows 8 began to refuse to install windows updates.  I've been through the troubleshooting steps in Help and online.

    Now, what I mean is "Windows could not search for new updates", code 80073712.

    Troubleshooting Windows Update tool, solve problems as an administrator, gives:

    Error Windows Update Database that can be detected 0 x 80073712... Fixed.

    Windows Update components and need to be repaired... Fixed.

    I'm skeptical about the 'Fixed' part, because if you run it again... he finds and it 'fixed' the same problem.

    DISM.exe/online/Cleanup-image /Restorehealth and /scanhealth the two report error 14098: component store has been corrupted.

    Feel free to ask me questions to debug it, I'm fairly technical...

    Hello

    You can try this fix based on Windows PowerShell and see if that helps:

    http://www.kapilarya.com/fix-Windows-8-1-Unable-to-check-for-new-Windows-updates

    Hope this helps, good luck :)

  • What file to log/trace to look for?

    If the database is not accessible to the TNSPING, SQLPlus or any application. What is the log file to search for messages in error reported in Oracle?
    What should be the starting point to solve problems?
    Oracle 10g R2.
    Thank you
    Smith

    user517525 wrote:
    Thank you. My connections are currently. I was trying to learn the means of troubleshooting.

    Ah, referring to your original post, good starting point would be always search for the error message. It's really sense of wanting to give any type of troubleshooting, if we don't know yet what is the error.

    However, I will give you some principles for connectivity issues.

    (1) straight right which is a client process and a process Server . Any program that you use to connect to the database (sqlplus, iSqlPlus Toad, local SQL, Excel (via odbc), some app developer) is the client to the database. It does not matter if that deal happens to run on the same square as the database, it's always a client process.

    (2) according to the application and its architecture, the client process may be on your desk, on the database server, or some other box (intermediate level). Yet once the database really cares.

    (3) customers and only customers, use tnsnames.ora to solve a connection string to a host address, port, and the name of the service. (There are other methods besides tnsnames, but they aren't nearly as often).

    (4) the auditor is a process from the side Server . As such, he doesn't know or care about any file tnsnames.ora.

    (5) If you define a database connection, the database where the link is defined becomes a client to the database that is the target of the link. Yet once, continue straight in your mind who is the client and server.

    Once again, all true troubleshooting begins with an error message. Look it up. Understand that. Believe it. The database doesn't lie not.

  • What does it mean to select 'request to activate' for Add-ons?

    What does it mean to select 'request to activate' for Add-ons?
    It makes it safer, for example when using flash player?
    Or, when this option would be desirable?
    And I read this advice: "uninstall all versions of Java completely and see if you can manage without it. Otherwise, you can always install the latest version, when you need it. »
    So I was wondering - uninstall it would be safer just to assign to, "ask to activate" and (I guess?) that he ask me any time, she wants to exploit (and therefore to put my system in peril?)?
    Thanks for the tips!

    Request to activate is whenever Firefox ask your permission to run this plugin to make it safer.

    Always activate = a time what you choose this option, the plugin works automatically whenever it needs

    Never activate the plugin = never executed, until you change the option to "Ask to activate or always»

    More on this topic

  • What can I use to search for a Microsoft has agreed to AGP Pro graphics card to make a visible improvement on my computer screen?

    I have an ASUS computer (actually it's a DIY chassis and motherboard ASUS with CD/DVD player and it is a real improvement over what I used, but I want to upgrade a NVidia 6200 AGPto graphics card of PRO for an improvement in Visual acuity and a cleaner profile.) Most computer retail online places like Comp-USA sell all these PCI cards and same NEW EGG does not list Pro AGP card. So while I'm looking I thought why not find a "Microsoft approved" AGP card?

    Hello

    Step 1: You may need to search the drivers updated through windows update.

    See: http://www.update.microsoft.com/microsoftupdate/v6/vistadefault.aspx?ln=en-us

    Step 2: otherwise, you may need to search for drivers by using your favorite search engine.

    DISCLAIMER of THIRD PARTY SOFTWARE: Using third-party software, including hardware drivers can cause serious problems that may prevent your computer from starting properly. Microsoft cannot guarantee that problems resulting from the use of third-party software can be solved. Software using third party is at your own risk.

  • Search for the Explorer of Windows XP does not display option "what do you want to search for.

    When I open the Explorer search in windows XP, the dog still works without the option "what do you want to search for" and other options. How can I solve this problem?

    * original title - search for windows problem images *.

    Hi true-do,.
     
    -Remember you proceed with recent computer between the calendar changes when things worked fine and now?
     
    This problem may occur if one or more of the Jscript registry key settings are incorrect. This problem can also occur if the Jscript.dll file is missing or damaged.
     
  • "Can not open AsIO.sys (2)" I get this message when I log in after a reboot. I have search for the file, but can't find it with the research or the command prompt. What do do in this file, and can be created and put into the appropriate folder?

    "Can not open AsIO.sys (2)" I get this message when I log in after a reboot.  I have search for the file, but can't find it with the research or the command prompt.  What do do in this file, and can be created and put into the appropriate folder?

    Hi Jack,

    This driver belongs to AsIO.sys Asus Probe. Try to uninstall Asus Probe and if you need, install again. If this does not help, uninstall Asus Probe and other tools of control such as Speedfan. Open the registry (regedit.exe) editor and search for AsIO.sys and remove all the entries that you can find.

    André
    "A programmer is just a tool that converts the caffeine in code" Deputy CLIP - http://www.winvistaside.de/

  • Windows 8 crashes when I try to view the apps or search for what

    I use Windows 8 and everything worked well until about 1 week after my purchase, a few days ago, my computer crashes whenever I try to view my apps or use the search function. When I click on 'applications' or try to pick up anything, the computer hangs for about 5 seconds, then returns to the home metro screen. This means I have no way to open applications except statement on the desktop, open the Explorer and manually search for the executable file. Needless to say, it's still more embarrassing than to not have a start menu first. Any help would be greatly appreciated.

    I haven't tried the no update method after you refresh my computer, always had this problem. I decided to go ahead and download the updates last night and today no more problems!

  • IM ' all the app "creative cloud 'all-inclusive' adobe, the price says $ 49 99 / mo for the annual plan, paid monthly. What means the small 99 means beside the number 49. This means that the price is 49.99 USD for annual paid monthly plan?

    IM ' all the app "creative cloud 'all-inclusive' adobe, the price says $ 49 99 / mo for the annual plan, paid monthly. What means the small 99 means beside the number 49. This means that the price is 49.99 USD for annual paid monthly plan?

    Yes. USD 49. 99

    Fenja

  • Hi, I have Creative cloud together, is what it means that I can download MUSE for free?

    Hi, I have Creative cloud together, is what it means that I can download MUSE for free?

    Muse is included in the complete package.  All Cloud Applications: http://www.adobe.com/creativecloud/catalog/desktop.html

    You can download any Adobe application.  The cost is when you want to use it beyond a trial period.  Since you have already paid, you can use the software at will.

  • Search for content of a file in Windows 7 does not work. What I am doing wrong?

    I read a bunch of messages on this website, as well as others, on the way to search for content in a file. I followed the instructions, but it does not work for me.

    As I understand it, if I'm looking for a file containing the word 'pelican', I must type

    content: "Pelican".

    It does not work.

    I also read that it speeds up the search if I turn on indexing. This is not feasible because there is more than 4 TB with a value of files on my company's server and indexing is apparently intended to apply only to files that are frequently used in areas that are frequently used.

    I guess I'm doing something wrong, because I've seen post this question even others and tell then the answer has worked for them, but it does not work for me.

    Any help would be appreciated.

    Just type Pelican in fact, content: is not necessary.

    If you do not want to reserve a site indexed, there is an option that you can set to make a slow files manual scan (although it might take hours or days or weeks for the search engine to open and analyze inside 4 TB with a value of files over a slow network connection.  I hope that the server is indexing on, even if you do not have.  If this isn't the case, you'll be sorely out of luck.

    This setting, I've mentioned is here:

Maybe you are looking for

  • Lost Japanese input

    Hello I lost my Chinese & Japanese entry from my mac os x 10.11.6 (15-1004). > System Preferences > keyboard > input source. Could not find any Chinese and Japanese... I can't do a job, how to solve this problem?

  • Legend of unwanted cursor position reset

    Good afternoon I use an XY Chart with a legend of visible cursor, in LabVIEW 2009. The legend of cursor has 5 sliders on it, but because of space constraints, two can only be visible at once, and you use the scroll bar to see the lower sliders. Howev

  • How can I get my projector to macromedia to begin working again

    Help, please

  • Error code 646 for the Vista updates

    Still cannot load updates 11. Follow-up to this process: Method 1: Save the Windows Update files 1. click Start and type notepad in the box start the search . 2. click on Notepad in the programs list. 3. copy the following commands, and then paste th

  • WRT320N - support for PPTP and L2PT DCHP?

    Hello, I bought this router and facing the problem - how to establish an internet connection. My ISP supports only DHCP for PPTP and L2TP, it gave me the URL (vpn.corbina.net and tp.corbina.net). I found a topic in a local forum with an explanation h