Versions (4)
Version DetailsCurrent
Rev: 3 • Dec 12, 2012, 12:00 PMET MALWARE DNS Query to Pseudo Random Domain for Web Malware (.mynumber.org)
alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query to Pseudo Random Domain for Web Malware (.mynumber.org)"; dns_query; content:".mynumber.org"; nocase; isdataat:!1,relative; pcre:"/^[acdefghijlmopqrtwz]{16}\.mynumber\.org$/"; reference:url,blog.lab69.com/2012/12/another-implementation-of-pseudo-random.html; classtype:bad-unknown; sid:2018766; rev:3; metadata:created_at 2012_12_12, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)
Dec 12, 2012, 12:00 PM
Jul 26, 2019, 12:00 PM
Sep 21, 2024, 3:00 AM
Oct 8, 2025, 9:38 PM
rules/emerging-malware.rules