Skip to main content
Tutek
Tutek
New Member
January 4, 2022
Question

Fortianalyzer shows DC as compromised host

  • January 4, 2022
  • 2 replies
  • 5351 views

Hi,

I have internal domain dns server on domain controller, Fortianalyzer shows this host as compromised with multiple attempts to websites like:

zmarsa.com Malware CnC Spyware and Malware infected-domain
com.tr Malware CnC Not Rated infected-domain
techcdn.com Malware CnC Spyware and Malware infected-domain
and others.
First of all, my all servers have blocked internet access, and the second when I check Cached Lookups on my domain controller dns I can't find neither of these domains from Fortianalyzer logs.
Could anyone could me explain how could I troubleshoot these attempts and source of them?
 
 

2 replies

A
Anonymous_User
Contributor
January 6, 2022

Hello Tutek,

 

Do you also log on Syslog server? Hope you will find some information in there.

 

Also, can you check if all the logs are been forwarded from the firewall to the Fortianalyzer, can you check on the firewall if you can find anything from the logs in the firewall.

Let us know if that helps.

Debbie_FTNT
Staff & Editor
Debbie_FTNT
Staff & Editor
January 7, 2022

Hey Tutek,

 

if you check the compromised host details on FortiAnalyzer, by right-clicking you should be able to get to the underlying logs FortiAnalyzer received, which made it reach the compromised verdict.

I would suggest checking traffic and/or security logs with source IP of your domain controller to figure out if there is in fact any traffic going to the internet from your DCs. If there is such traffic, the logs should tell you what policy allows that traffic, you can lock down the access, and then figure out if your domain controllers are actually compromised or not.

Hope this helps!

Terms & ConditionsAccessibility statement