Rule History

SID: 2014267 • Source: et/open

Versions (2)

Version DetailsCurrent

Rev: 2 • Feb 21, 2012, 12:00 PM

Message:

ET MALWARE Query for Known Hostile *test.3322.org.cn Domain

Rule:

alert dns $HOME_NET any -> any any (msg:"ET MALWARE Query for Known Hostile *test.3322.org.cn Domain"; dns.query; dotprefix; content:".test.3322.org.cn"; nocase; endswith; reference:url,www.sans.org/reading_room/whitepapers/malicious/detailed-analysis-advanced-persistent-threat-malware_33814; reference:md5,e4afcee06ddaf093982f80dafbf9c447; classtype:trojan-activity; sid:2014267; rev:2; metadata:created_at 2012_02_21, signature_severity Major, updated_at 2024_03_25;)

Created:

Feb 21, 2012, 12:00 PM

Updated:

Mar 25, 2024, 12:00 PM

DB Created:

Feb 21, 2012, 12:00 PM

DB Updated:

Sep 10, 2024, 1:01 PM

Filename:

rules/emerging-malware.rules