Porthos Posted May 10, 2022 ID:1515006 Share Posted May 10, 2022 -Website Data- Category: RiskWare Domain: wmail-service.com IP Address: 104.21.4.86 Port: 80 Type: Outbound File: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Link to post Share on other sites More sharing options...
Staff TeMerc Posted May 10, 2022 Staff ID:1515012 Share Posted May 10, 2022 23 minutes ago, Porthos said: -Website Data- Category: RiskWare Domain: wmail-service.com IP Address: 104.21.4.86 Port: 80 Type: Outbound File: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thanks- looks like threats are now 404, will get this disabled Link to post Share on other sites More sharing options...
Maurice Naggar Posted May 10, 2022 ID:1515035 Share Posted May 10, 2022 Hi. Actually the Block event, led to discovery of a MS VBS exploit via a rogue scheduled task. 2 cases in malware removal now in progress. 1 Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted May 10, 2022 Root Admin ID:1515039 Share Posted May 10, 2022 This block was put back in place due to association with a PowerShell coin-miner 1 Link to post Share on other sites More sharing options...
Recommended Posts