Rule History

SID: 2012115 • Source: et/open

Versions (4)

Version DetailsCurrent

Rev: 8 • Dec 30, 2010, 12:00 PM

Message:

ET INFO DNS Query for a Suspicious Malware Related Numerical .in Domain

Rule:

alert dns $HOME_NET any -> any 53 (msg:"ET INFO DNS Query for a Suspicious Malware Related Numerical .in Domain"; dns.query; content:".in"; fast_pattern; endswith; pcre:"/^(?:[0-9]{4,7})\x2ein$/i"; reference:url,sign.kaffenews.com/?p=104; reference:url,www.isc.sans.org/diary.html?storyid=10165; classtype:bad-unknown; sid:2012115; rev:8; metadata:created_at 2010_12_30, deprecation_reason Performance, confidence Medium, signature_severity Informational, updated_at 2024_03_27;)

Created:

Dec 30, 2010, 12:00 PM

Updated:

Mar 27, 2024, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

May 30, 2025, 12:04 AM

Filename:

rules/emerging-info.rules