LoFP LoFP / t1496

t1496

TitleTags
a dns lookup does not necessarily mean a successful attempt, verify a) if there was a response using the zeek answers field, if there was then verify the connections (conn.log) to those ips. b) verify if http, ssl, or tls activity to the domain that was queried. http.log field is 'host' and ssl/tls is 'server_name'.
legitimate crypto coin mining
legitimate use of crypto miners
some build frameworks
unlikely