This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ATP Meldung mygpuid.com

Habe heute bei mehreren Firewalls Meldungen von AdvancedThreatProtection
weil jemand versucht hat mygpuid.com via DNS aufzulösen.
Da die internen Clients zuerst den Windows DC befragen, kriege ich nur meinen DC als Quelle.
Ich hoffe, es ist nur ein FalsePositive.

Falls einer der Entwickler von ATP mitliest:
man könnte so eine DNS Anfrage auch auf eine Firewall IP umleiten, um den Client mal rauszukriegen.

This thread was automatically locked due to age.

Parents

0 vilic over 10 years ago

Same here, 9 hits from 2 different IPs for mygpuid.com.

Origin was proxy, which means it was direct DNS client request to UTM, not via internal DC/DNS server.
- atp3.png
- View
- Hide
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 vilic over 10 years ago

Same here, 9 hits from 2 different IPs for mygpuid.com.

Origin was proxy, which means it was direct DNS client request to UTM, not via internal DC/DNS server.
- atp3.png
- View
- Hide
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Acaelus over 10 years ago in reply to vilic

I too received this alert, much the same is the above linked image. At first I thought a user picked up some malware, but did a complete scan on the machine identified and found no issues.

Anyone taken the time to scrub the logs? *not it*
Cancel
Vote Up 0 Vote Down

Cancel