I have a host on the Network that tries to send TCP/IP Packets to various servers. The DST Port is always 80 or 443 and the Flags set are RST and ACK. These Packets are blocked by our firewall. I did whois request for all target addresses and it where all addresses of the Google Cloud or Akamai. All 100 Request where sent within a secound. This happend several times.
My Suspicion now is that there are no further packets sent because the malware realized that the packets are blocked by the firewall. Is this a reasonable idea or is there a less malicious explaination for this behaviour?
I wrote a script that fetches the certificate from all hosts that where listed in the firewall with TCP:RA to port 443. The Results showed that ~70% of that hosts had certificates for *.dropbox.com and to some other cloud based solutions. Seemingly the connection of these clients had been reset by servers by sending a packet with the RST Flag set which terminated the State in the firewall. The firewall then blocked the RST,ACK Answer from the client. So no malware in most cases. One host was actually infected.