Skip to main content
Tier One
High

Outbound connection to a known command-and-control server blocked

A-1057

00:00time on this alert, target 10 minutes

Back to queue

Alert details

Source
Firewall
Detection rule
FW-C2-BLOCKLIST-002
Affected user
j.rivera
Affected host
LAPTOP-JRIVERA
Source IP
194.36.191.44
First seen
2026-07-24T16:05:00Z

Why this fired, in plain English

A computer inside the network tried to talk to an address on our known-bad list, and the firewall stopped it.

Suggested playbook

Malware detection on an endpoint

  1. 1. Read the action field first: blocked/quarantined changes urgency dramatically versus alert_only.
  2. 2. Identify the process path. AppData, Temp and Users\Public are common malware locations.
  3. 3. Check the parent process — Office apps spawning shells is abnormal.
  4. 4. Look up the file hash for a verdict and first-seen date.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 3 events.

  1. Guided hint: this line matters

    ts=2026-07-24T16:04:12Z src="firewall" action=deny src_ip=10.20.22.80 dest_ip=194.36.191.44 dest_port=443 proto=tcp rule="c2-blocklist" bytes=0 app="unknown-tls"

    action=deny with bytes=0 means the connection never completed. Nothing was sent.

  2. Guided hint: this line matters

    ts=2026-07-24T16:04:12Z src="firewall" action=deny src_ip=10.20.22.80 dest_ip=194.36.191.44 dest_port=443 interval_sec=300 attempt_count=7

    Retrying every 5 minutes on a fixed interval is beaconing — malware calling home.

  3. Guided hint: this line matters

    ts=2026-07-24T16:04:15Z host=LAPTOP-JRIVERA sensor=edr event=process_network process="C:\\Users\\j.rivera\\AppData\\Roaming\\updtr.exe" dest_ip=194.36.191.44 parent_process="explorer.exe"

    An unsigned executable in a user's AppData folder is a very common malware hiding spot.

Related events

The order things happened in.

  1. 15:34Z

    First blocked beacon attempt

  2. 16:04Z

    Seventh attempt, alert raised

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 4 lookups checked

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.