Rule History

alert dns $HOME_NET any -> any any (msg:"ET MALWARE Backdoor Win32/IRCbot.FJ Cnc connection dns lookup"; dns.query; content:"minerva.cdmon.org"; fast_pattern; nocase; bsize:17; reference:url,www.bfk.de/bfk_dnslogger_en.html?query=minerva.cdmon.org; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3aWin32%2fIRCbot.FJ; reference:url,www.exposedbotnets.com/2011/02/minervacdmonorgbotnet-hosted-in.html; reference:md5,13e43c44681ba9acb8fd42217bd3dbd2; classtype:command-and-control; sid:2013187; rev:2; metadata:created_at 2011_07_05, malware_family Win32_IRCbot_FJ, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_07_15;)