AM Delta Patch downloading from External IP (Verizon)?

[Guest Nina X]

I came across one of our assets downloading something from below. I was highly suspicious of this initially.hxxp[://]151[.]205[.]24[.]71/data/011b83b7a121ab1a/9[.]au[.]download[.]windowsupdate[.]com/d/msdownload/update/software/defu/2022/07/am_delta_patch_1[.]371[.]455[.]0_af484f50cb49b7fd2a127f9cc0496d3f9393ffb3[.]exeThe IP resolves to Verizon and upon checking what the am delta patch is, it appears to be related to MS Security essentials check from reading the post below:Redirecting

 

Continue reading...