alert udp $HOME_NET any -> any 53 (msg:"ET TROJAN DNS Query Sinkhole Domain Various Families (Possible Infected Host)"; content:"|00 01 00 00 00 00 00 00|"; depth:8; offset:4; content:"|0f|torpig-sinkhole|03|org|00|"; nocase; distance:0; fast_pattern; reference:url,www.sysenter-honeynet.org/?p=269; classtype:bad-unknown; sid:2015813; rev:7;)

Added 2015-03-17 15:47:01 UTC


alert udp $HOME_NET any -> any 53 (msg:"ET TROJAN DNS Query Torpig Sinkhole Domain (Possible Infected Host)"; content:"|00 01 00 00 00 00 00 00|"; depth:8; offset:4; content:"|0f|torpig-sinkhole|03|org|00|"; nocase; distance:0; fast_pattern; reference:url,www.sysenter-honeynet.org/?p=269; classtype:bad-unknown; sid:2015813; rev:5;)

Added 2014-09-19 17:22:44 UTC


alert udp $HOME_NET any -> any 53 (msg:"ET CURRENT_EVENTS DNS Query Torpig Sinkhole Domain (Possible Infected Host)"; content:"|00 01 00 00 00 00 00 00|"; depth:8; offset:4; content:"|0f|torpig-sinkhole|03|org|00|"; nocase; distance:0; fast_pattern; reference:url,www.sysenter-honeynet.org/?p=269; classtype:bad-unknown; sid:2015813; rev:4;)

Added 2012-10-19 17:25:45 UTC


alert udp $HOME_NET any -> any 53 (msg:"ET CURRENT_EVENTS DNS Query Torpig Sinkhole Domain (Possible Infected Host)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|torpig-sinkhole|03|org|00|"; nocase; distance:0; fast_pattern; reference:url,www.sysenter-honeynet.org/?p=269; classtype:bad-unknown; sid:2015813; rev:3;)

Added 2012-10-18 01:34:53 UTC


Topic revision: r1 - 2015-03-17 - TWikiGuest
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats