1

A firewall in my company was triggered by a DNS query from one of our laptops. Specifically, the exact reason was MALWARE-CNC Win.Trojan.Zeus v3 DGA DNS query detected.

Now, I could just follow this blindly and nuke the laptop in question from orbit, but this is disruptive and time-consuming. Ideally, I'd like to get confirmation that the problem is, in fact, this particular laptop and that it has been infected. The problem is, all attempts to actually confirm this have failed. All machines in the company are running up-to-date Windows Defender, and that hasn't reported anything and I've also scanned the laptop with a Kaspersky Recovery Disk, which also found nothing.

Is the Zeus bot basically undetectable beyond the DNS queries or does it leave a trace (like registry entries or other specific files that could be clear signals of an infection)?

EDIT: Not sure if this is helpful, but this is the whole logged entry:

2019:04:02-13:25:00 firewall snort[5508]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="MALWARE-CNC Win.Trojan.Zeus v3 DGA DNS query detected" group="241" srcip="10.150.4.104" dstip="10.150.1.34" proto="17" srcport="54103" dstport="53" sid="26267" class="A Network Trojan was Detected" priority="1" generator="1" msgid="0"
2019:04:02-13:25:09 firewall snort[5508]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="MALWARE-CNC Win.Trojan.Zeus v3 DGA DNS query detected" group="241" srcip="10.150.4.104" dstip="10.150.1.34" proto="17" srcport="58112" dstport="53" sid="26267" class="A Network Trojan was Detected" priority="1" generator="1" msgid="0"

We're using Sophos UTM which has a prepared Snort rule set. I believe the ruleset can be viewed here: https://lists.astaro.com/ASGV9-IPS-rules.html

| improve this question | |
  • It's very possibly a false positive. Do you know what rules are used to trigger that reason? – forest Apr 3 '19 at 7:16
  • @forest I'll edit the question to include more information. – Shaamaan Apr 3 '19 at 7:41
  • It looks like snort.org/rule_docs/1-26267. From a quick search, it seems like it's possible for this to be a false positive. – forest Apr 3 '19 at 7:44
0

I experienced this exact problem and my Sophos firewall also indicated the same warning two times in close succession. After that, there has been no further warning. Two additional observations here that really confuse me: 1). The laptop in question is a macbook running macOS 10.14.3, and 2). The laptop was not running at the time reported in the logs.

The firewall is Linux-based and my only Windows machine is on a separate subnet. All our other devices are wireless running ios 12.2

I can only explain that as a false positive.

One small correction: My laptop was closed but apparently was still pinging the network, according to the logs.

CRIT-861: MALWARE-CNC Win.Trojan.Zeus v3 DGA DNS query detected

| improve this answer | |
0

I would advise to put the local windows firewall of the laptop logging.

If get confirmation that it is the machine that is doing the queries try to identify the process.

If so then try to check the process that is doing a call with netstat or using the process explorer tool from sysinternals. Probably the best tool might be Microsoft Network Monitor tool as it will map the network traffic to the process while sniffing it.

After identifying the process with both tools you will get the the application that is doing the call. Then you will be able to analyze it and check exactly what it is...

I would also advise you to understand the snort rule better and see how it works. Some rules are only monitoring activity in specific tcp ports and therefore prone to false positives.

| improve this answer | |
  • The warning was triggered two times in close succession, as the logs indicate. Since then our firewall didn't detect any hits. As such, I don't think I can use things like the Network Monitor tool. Even firewall logs might be less than useful at this point as I don't know when the next hit might be (unless your recommendation is to have them turned on indefinitely). – Shaamaan Apr 4 '19 at 6:39
  • Hi Shamman that will be depending on the security posture and on what the rule is actually monitoring. I still think if the rule is efficient and is really monitoring a specific signature and the risk is not acceptable then he needs to find the "what" answer. If the rule is prone to false positives and not efficient then I would agree with you and will not lose much time with low hit values as the probability of true positive is lower. – Hugo Apr 4 '19 at 12:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.