Versions (3)
Version DetailsCurrent
Rev: 9 • Feb 21, 2011, 12:00 PMET HUNTING All Numerical .ru Domain Lookup Likely Malware Related
alert dns $HOME_NET any -> any any (msg:"ET HUNTING All Numerical .ru Domain Lookup Likely Malware Related"; dns.query; content:".ru"; endswith; fast_pattern; pcre:"/^(?:[0-9]{2,30})\x2eru$/i"; content:!"101.ru"; endswith; content:!"9366858.ru"; endswith; classtype:misc-activity; sid:2012328; rev:9; metadata:created_at 2011_02_21, deployment Perimeter, deployment Internal, deprecation_reason Performance, performance_impact Significant, confidence Medium, signature_severity Informational, updated_at 2024_03_26;)
Feb 21, 2011, 12:00 PM
Mar 26, 2024, 12:00 PM
Sep 21, 2024, 3:00 AM
May 30, 2025, 12:04 AM
rules/emerging-hunting.rules