topic Re: FirePower Security Intelligence Question in Network Security

FirePower Security Intelligence Question

-Sparrow- — Thu, 07 Nov 2019 20:42:01 GMT

Hello,

I've noticed an increase in IOC's being triggered due to hosts attempting to access hxxps://gogo.thepowerrangers.com.

End users are obviously not trying to get to a power rangers site. It seems to be a URL redirect. Has anyone else found their FirePower SI blocking this site? It's happening multiple times a day and I'm unsure what's triggering this. Google is not my friend here.

I had the same issue a few weeks ago with hxxps://mv-s2s-dev.ngrok.io. That URL has subsided for the time being.

Thank you

Re: FirePower Security Intelligence Question

Sheraz.Salim — Sat, 09 Nov 2019 21:44:09 GMT

To check the URL health go to https://www.brightcloud.com/tools/url-ip-lookup.php check firepower url engine use the statistics from this engine.

now coming back to your point. if you think this url is malicious and you need to block the rule here

Re: FirePower Security Intelligence Question

-Sparrow- — Wed, 13 Nov 2019 18:51:31 GMT

Thanks Sheraz,
I don't necessarily think the URL is malicious, but Talos thinks it is which causes a lot of IOC's every day for hosts on our network. I just blacklisted the URL(s) and the IOC's went away. Nobody has complained yet. That's probably going to be how I resolve this in the future. Blacklist and be done with it.
Thanks!

Re: FirePower Security Intelligence Question

nspasov — Wed, 13 Nov 2019 19:14:06 GMT

Yes, you can always utilize the white/blacklist in such situations. Also, just to mention, you can always submit a dispute directly to TALOS through the following link:

https://talosintelligence.com/reputation_center/support

Thank you for rating helpful posts!