Rule History

alert udp any 53 -> $HOME_NET any (msg:"ET DELETED Possible Kelihos .eu CnC Domain Generation Algorithm (DGA) Lookup NXDOMAIN Response"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|02|eu|00|"; fast_pattern; pcre:"/\x00\x07[a-z0-9]{7}\x02eu\x00/"; threshold: type both, track by_src, count 2, seconds 60; reference:url,web.archive.org/web/20120320025955/http://www.abuse.ch/?p=3658; reference:url,marc.info/?t=135207100900022&r=1&w=2; reference:url,www.justice.gov/opa/pr/justice-department-announces-actions-dismantle-kelihos-botnet-0; classtype:command-and-control; sid:2014372; rev:8; metadata:created_at 2012_03_14, confidence High, signature_severity Unknown, updated_at 2023_05_04;)