Bad External Server IP Address

This alert occurs when Lacework detects an internal host connects to an IP address that has been flagged as malicious by intelligence sources. If an application cannot be associated with a connection, Lacework generates a machine alert.

Why this Alert is Important

Connecting to a known, bad IP may be the result of a compromised application or malware. The malicious IP is typically a C&C server, and a compromised host may be used for anything from crypto-mining to DDOS attacks.

Investigation

Verify that the IP was added to a denylist or blocklist using other sources. Examine any data transfer and determine if meaningful data has been exchanged - over 10 KB per connection. Look at the direction of transfer, for example, if this application does not typically connect to the Internet, even data transfer less than 10 KB per connection may indicate C&C (Command-and-Control).

Resolution

If the IP address is confirmed to be malicious, block the IP address and scan the local machine. Perform local forensics and then restore the machine to a known good state.