WWYD Socialize.null Requests

Here to help

WWYD Socialize.null Requests

I am getting some reports from the security center, these alerts are regarding .null requests to what seem to be legitimate places. The alerts state that they are coming from our Domain Controller and the requests are being made to multiple different IP addresses that check out from VirusTotal and Shodan. 

Sid 1-48666 from Snort is blocking the .null requests which flag as a indicator of compromise. Alerts are only being generated during work hours. 


I would like to know what steps you all would take to investigate/resolve this issue. 







1 Reply 1
Kind of a big deal
Kind of a big deal

Enable logging on your DNS servers, and see which clients are making the .null requests.


Get notified when there are additional replies to this discussion.