This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[Sophos Notification] RESOLVED - Advisory: Sophos UTM - ATP is blocking traffic to Windows Update server (93.184.221.240)

Hi Community,

[Update] Sophos has updated the pattern version and the IP should no longer be blocked. Customers should perform a manual pattern update.

Sophos is investigating reports of ATP blocking traffic to Windows Update server at 93.184.221.240.

This advisory article has been published and will be updated when more information becomes available.

This thread was automatically locked due to age.

+1 FloSupport over 5 years ago

[Update] Sophos has updated the pattern version and the IP should no longer be blocked. Customers should perform a manual pattern update.

Florentino
Director, Global Community & Digital Support
Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question, please use the 'Verify Answer' button.

The Award-winning Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Cancel
0 nd over 5 years ago in reply to FloSupport

Yeah, so I was a little bit scared watching that today.... so this IP is definitely from ms-update? searching for this IP was not so easy. and the more confusing fact was, the second firewall behind did not result in an alert.
Cancel
Vote Up 0 Vote Down

Cancel
0 Florian Bartsch over 4 years ago in reply to FloSupport

Hey FloSupport,

issue is coming up today for us again:

C2/Generic-A e13678.dspb.akamaiedge.net 6 DNS

Also since some days there is a website that is creating entries:

C2/Generic-A www.format-baeder.de 4 Proxy

Also it would be nice if you can tell me how I'am able to find out which are false positives and which are a serious security problem?

We can scan our systems after messages like that but this isnt really helpful.

Thank you.

Greetings,

also Flo
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 4 years ago in reply to Florian Bartsch

Hi Florian Bartsch

Thank you for reaching out to the Community!

I would request you to follow this KB Article: Sophos UTM: How to troubleshoot an ATP detection

Additional information on how to detect which client machines are making requests to those hostnames: https://community.sophos.com/products/unified-threat-management/f/network-protection-firewall-nat-qos-ips/120293/sophos-utm9-advanced-threat-protection-have-threat-name-c2-generic-a-events-for-ad-dns-server/437722#437722

PS: ATP alerts triggered by domain "e13678.dspb.akamaiedge.net" has been resolved by the LAB.

Please update us if you are still getting ATP alerts for the same domain.

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel