Forum Discussion
Ravi575
Mar 20, 2025Copper Contributor
Investigating ASR Alert: Tracing the Source URL for C&C Activity
Hello everyone
I encountered an alert in Microsoft Defender indicating that a URL was blocked as a Command and Control activity. While investigating, I noticed multiple URLs accessed prior to the flagged one, including ad traffic. However, I am unable to identify the source URL that triggered this activity.
Could anyone suggest advance hunting queries or any other investigative approaches to help trace the Source URL? I am particularly interested in methods to correlate this URL with preceding network events or processes.
Thanks
2 Replies
Sort By
- caferormanCopper Contributor
Can you include a screen grab of the alert or any other relevant information?