Versions (6)
Version DetailsCurrent
Rev: 5 • Mar 14, 2012, 12:00 PMET MALWARE Possible Zeus .ru CnC Domain Generation Algorithm (DGA) Lookup Detected
alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE Possible Zeus .ru CnC Domain Generation Algorithm (DGA) Lookup Detected"; byte_test:1,!&,0xF8,2; content:"|02|ru|00|"; fast_pattern; pcre:"/[^a-z0-9\-\.][a-z]{32,48}\x02ru\x00\x00/"; classtype:command-and-control; sid:2014376; rev:5; metadata:created_at 2012_03_14, deprecation_reason False_Positive, confidence High, signature_severity Major, updated_at 2025_12_16;)
Mar 14, 2012, 12:00 PM
Dec 16, 2025, 12:00 PM
Sep 21, 2024, 3:00 AM
Dec 16, 2025, 10:34 PM
rules/emerging-malware.rules