Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE HTTP Connection To Known Sinkhole Domain sinkdns.org"; flow:to_server,established; http.host; content:".sinkdns.org"; pcre:"/^(\x3a\d{1,5})?$/R"; classtype:trojan-activity; sid:2017838; rev:4; metadata:created_at 2013_12_12, confidence High, signature_severity Major, updated_at 2022_07_12;)