Skip to main content

Outbound Connection To a Bad External URL

This alert occurs when Lacework detects connections made to a known bad URL.

Why this alert is important​

Outbound connections to bad URLs can indicate a compromised application or malware. Some examples of bad external URLs include:

  • Phishing websites: Websites designed to steal sensitive information such as login credentials or credit card details.

  • Malware distribution sites: Websites that distribute malware, viruses, or other malicious software.

  • Command-and-control servers: Servers used by hackers to control compromised devices and carry out cyberattacks.

  • Adult or gambling sites: Sites that are inappropriate for workplace use and may expose your organization to legal or reputational risks.

Investigation​

Detecting outbound connections to bad external URLs is an important aspect of network security. Here are some ways you can detect these types of connections:

  • Use web filtering software: Web filtering software can be used to block access to known malicious websites and prevent users from connecting to bad external URLs. These tools can also help you monitor web traffic and identify any suspicious activity.

  • Use network monitoring tools: Network monitoring tools can be used to track all outgoing traffic from your network and alert you when connections are made to known bad external URLs. These tools can also help you analyze traffic patterns and identify potential security threats.

  • Monitor firewall logs: Firewall logs can provide information on which IP addresses are being blocked and which are being allowed through. By reviewing firewall logs, you can identify outbound connections to known bad external URLs and take action to block them.

  • Conduct security audits: Conduct regular security audits of your network to identify any vulnerabilities that may be exploited by attackers. These audits can help you identify any unauthorized connections to bad external URLs and take steps to prevent them from happening in the future.

  • Use antivirus software: Antivirus software can help detect and prevent malware infections that may be causing outbound connections to bad external URLs.

Resolution​

Follow these recommended steps to prevent outbound connections to a bad URL:

  • Identify the source: Determine which device or user made the outbound connection to the bad external URL. This can help you narrow down the scope of the problem and prevent it from happening again in the future.

  • Block the connection: Immediately block the connection to the bad external URL to prevent any further communication between your network and the malicious website. You can do this by configuring your web filtering software, firewall, or other network security tools.

  • Conduct a security scan: Conduct a security scan of the affected device to detect any malware or viruses that may have caused the outbound connection to the bad external URL. Use an up-to-date antivirus software and ensure that all security patches are applied.

  • Review security policies: Review your organization's security policies and procedures to ensure that they are up to date and effective in preventing similar incidents in the future. Consider implementing additional security measures such as network segmentation, data loss prevention tools, and user training.

  • Educate users: Educate your employees on safe browsing practices and the risks associated with connecting to bad external URLs. Encourage them to report any suspicious activity they may encounter while using the internet.