Versions (3)
Version DetailsCurrent
Rev: 14 • May 4, 2012, 12:00 PMET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Opcode 6 or 7 set
alert udp $HOME_NET !9987 -> $EXTERNAL_NET 53 (msg:"ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Opcode 6 or 7 set"; content:!"7PYqwfzt"; depth:8; content:!"r6fnvWj8"; depth:8; byte_test:1,!&,64,2; byte_test:1,&,32,2; byte_test:1,&,16,2; threshold:type limit, count 1, seconds 120, track by_dst; reference:md5,a56ec0f9bd46f921f65e4f6e598e5ed0; reference:url,vrt-blog.snort.org/2008/08/checking-multiple-bits-in-flag-field_29.html; classtype:policy-violation; sid:2014701; rev:14; metadata:created_at 2012_05_04, deprecation_reason Performance, signature_severity Informational, updated_at 2024_07_02;)
May 4, 2012, 12:00 PM
Jul 2, 2024, 12:00 PM
Sep 21, 2024, 3:00 AM
May 30, 2025, 12:04 AM
rules/emerging-dns.rules