Skip to main content
cleuson
cleuson
New Member
October 16, 2018
Question

Host infected with botnet

  • October 16, 2018
  • 2 replies
  • 3916 views

Hi, we have a network with the 1500D fortigate on the edge. Inside we have several subnets. Behind one of the networks, we have a source botnet of ip x.x.x.x destined for an external network y.y.y.y How can I block conficker actions on the network?

 

Thank You.

    2 replies

    emnoc
    emnoc
    New Member
    October 16, 2018

    You  should  have a endpoint  agent on the host imho. But if you wanted to block the hosts set a  rule for the src and dst & with a deny action.

     

    Alternative you could  look a IPS signature and deploy that to catch others. Serious if your  having  infected host with conficker than you have out of date hosts and no or poorly maintained   local AV/Malware end-points.

     

     

    kphed
    kphed
    New Member
    October 16, 2018

    Configure an app sensor with the "Botnet" category set to block and either deploy it on an interface-policy for the local interface (to ensure all traffic sourcing from LAN is scanned) or deploy the app. sensor on which ever firewall policy allows the host outbound to the iNet.

    emnoc
    emnoc
    New Member
    October 16, 2018

    I would  be  careful with that.  bot app controls blocks known  C&C and listed or Identified botnets. YMMV  in detection and prevention.

     

    Ken Felix

    Terms & ConditionsAccessibility statement