False positive on google.com.onion AP check

Feedback & Support
1

Hey,

I’d like to reach out to consult (a quite likely possible) FP of a SID EveBox Rules

This SID fires every time phones connect to the network - apparently, due to Samsung’s “Detect suspicious networks” feature, which sends a bunch of fishy DNS requests when connecting to a new AP. But Samsung might not be the only vendor doing it.

In this case, the offensive DNS request is google.com.onion

The most helpful source:

Attaching captured pcap too.

3@251127-YgBNkp0ZOrdNC7rybRZCBozi.pcap (116 Bytes)

I am not familiar with rule evaluation too much, so I guess, do as you wish :slight_smile:

2

Thanks @lukashino ! We classify this as an INFO/POLICY rule at informational severity. I’m hesitant to add-in a UA string or specific domain safelist to this signature since it’s working as designed in this case. Can you do a local tune if the events are interfering with your workflows?

3

Hey, thanks for the reply.

Yeah, I will locally adjust to my environment.

1 Like