1

In my SIEM tool, I got multiple alerts for communication with malware sites from Palo Alto firewall.
I have seen many outbound communications from internal IPs toward IP: 74.217.31.51 having host name: match.basebanner.com which is having many blacklisted domains to which internal host are communicating.

Reference:
https://www.virustotal.com/en/domain/match.basebanner.com/information/
https://www.virustotal.com/en/ip-address/74.217.31.51/information/

Now I need to find out why these machines are communicating to these IPs. How to trace them and what proper remediation that I should recommend to my client to handle them?

4
  • You monitor a SIEM for a client, but have no access to the client's network or machines? Tell your client to run virus scans on the source IPs and look for adware. – schroeder Dec 4 '15 at 17:48
  • any thing else i can ask them like to check the process which is initiating the communication . if yes how to check those process – santosh407 Dec 4 '15 at 17:50
  • I am confused that you monitor SIEM but have no Incident Response procedures with your client. Does your client have knowledgeable technicians or are they non-technical people? – schroeder Dec 4 '15 at 17:52
  • I have to provide them remediation so that accordingly they can proceed. they will be having technicians but initially we provide the alert to a non technical and then he transfer the issue to technical guy. So they always ask for remediation steps as what to do for issues. – santosh407 Dec 4 '15 at 17:56
1

Tell your client that they need to run virus scans on the source IPs and to inspect the browsers of those machines. They can also run netstat on the Windows machines:

netstat -a -o -p TCP

That will show them the process that initiated each TCP connection.

Once they know what is triggering the connections, they can plan how to address the problem.

2
  • the problem is I am having only logs i don't have access to client machines . So maximum i can ask them to scan the machines which mostly give no result of infection. also when machines are >200 how to proceed with finding the issue. or the main source of infection – santosh407 Dec 4 '15 at 17:44
  • @santosh407 I edited the question based on our chat – schroeder Dec 4 '15 at 20:19
1

If I understand your infrastructure right, on the client, use:

$ lsof | grep <blacklisted-IP>

This command will list all open files. In your case, open TCP sockets. The grep will uncover if the is at the other end of the socket. This works on linux.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.