Rule History

SID: 2018517 • Source: et/open

Versions (5)

Version DetailsCurrent

Rev: 3 • Jun 4, 2014, 12:00 PM

Message:

ET DNS Reply Sinkhole FBI Zeus P2P 1 - 142.0.36.234

Rule:

alert dns any any -> $HOME_NET any (msg:"ET DNS Reply Sinkhole FBI Zeus P2P 1 - 142.0.36.234"; content:"|00 01 00 01|"; content:"|00 04 8e 00 24 ea|"; distance:4; within:6; classtype:trojan-activity; sid:2018517; rev:3; metadata:created_at 2014_06_04, deprecation_reason Relevance, confidence High, signature_severity Minor, updated_at 2024_03_07, reviewed_at 2024_03_07;)

Created:

Jun 4, 2014, 12:00 PM

Updated:

Mar 7, 2024, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

May 30, 2025, 12:04 AM

Filename:

rules/emerging-dns.rules