Think you have a false positive on this rule?

Sid 1-50768

Message

MALWARE-CNC Win.Trojan.BONDUPDATER outbound DNS tunnel

Summary

his event is generated when BONDUPDATER DNS tunneling beacons are detected.

Impact

A Network Trojan was detected

Detailed information

Affected systems

Ease of attack

False positives

False negatives

Corrective action

Contributors

  • Cisco Talos Intelligence Group

Additional References

  • virustotal.com/gui/file/de620a0511d14a2fbc9b225ebfda550973d956ab4dec7e460a42e9d2d3cf0588