3 ms·
I implemented the Suricata rules and found some positive indicators outbound to 4 different Akamai hosted endpoints on port 80. I forwarded the information to A
by stevenlafl 3y ago
I implemented the Suricata rules and found some positive indicators outbound to 4 different Akamai hosted endpoints on port 80. I forwarded the information to Akamai.
104.113.24.20
23.38.164.37
23.63.214.115
23.64.100.151
However, the detection techniques on the host machine yielded no results (yara, volatility3) nor were any files found at the common locations on disk or in registry mentioned.
It does seem odd that virtually all of these are Akamai, leading me to believe it may be a false positive, which was stated as a possibility in the article. If it is and something suddenly stops working I'll report back here.
- antiviral 3y agoThanks for doing this. Please do provide an update if you find anything.