TCP-Over-DNS Traffic Evasion Application Detection

Haridoss,

Thanks for your response!  I opened a ticket with your support and they provided this from the documentation.  Thanks again for your help.

See the below information on Sophos Live Protection:

How does it work?

LiveProtection will perform a lookup for any file it suspects of being malware; the following events will trigger a lookup

• Whenever a file is added to the endpoint’s quarantine manager.
• Whenever reported internally by the anti-malware engine that a file is deemed suitably suspicious.
• Whenever reported internally by anti-malware engine that a file is to be checked against a allow list defined by SophosLabs. (The allow list is maintained by SophosLabs and contains a list of common and system files which the product should cache to improve performance.)

Lookups - further information

LiveProtection performs a lookup to ensure the most up to date protection as new information could have been discovered about the file since the last time it was scanned.

Lookups contain a limited amount of information and are designed to help SophosLabs analysts to package up specific malware related information (such as function bytes or other properties required) to increase accuracy of detections.

Lookups are performed over DNS and the average endpoint perform a large number lookups per day depending on the level of activity. During scheduled and on-demand scans the number will increase as all files on the system will be accessed which triggers an increased number of lookups compared to normal operations.