A firewall in my company was triggered by a DNS query from one of our laptops. Specifically, the exact reason was MALWARE-CNC Win.Trojan.Zeus v3 DGA DNS query detected
.
Now, I could just follow this blindly and nuke the laptop in question from orbit, but this is disruptive and time-consuming. Ideally, I'd like to get confirmation that the problem is, in fact, this particular laptop and that it has been infected. The problem is, all attempts to actually confirm this have failed. All machines in the company are running up-to-date Windows Defender, and that hasn't reported anything and I've also scanned the laptop with a Kaspersky Recovery Disk, which also found nothing.
Is the Zeus bot basically undetectable beyond the DNS queries or does it leave a trace (like registry entries or other specific files that could be clear signals of an infection)?
EDIT: Not sure if this is helpful, but this is the whole logged entry:
2019:04:02-13:25:00 firewall snort[5508]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="MALWARE-CNC Win.Trojan.Zeus v3 DGA DNS query detected" group="241" srcip="10.150.4.104" dstip="10.150.1.34" proto="17" srcport="54103" dstport="53" sid="26267" class="A Network Trojan was Detected" priority="1" generator="1" msgid="0"
2019:04:02-13:25:09 firewall snort[5508]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="MALWARE-CNC Win.Trojan.Zeus v3 DGA DNS query detected" group="241" srcip="10.150.4.104" dstip="10.150.1.34" proto="17" srcport="58112" dstport="53" sid="26267" class="A Network Trojan was Detected" priority="1" generator="1" msgid="0"
We're using Sophos UTM which has a prepared Snort rule set. I believe the ruleset can be viewed here: https://lists.astaro.com/ASGV9-IPS-rules.html