Rule History

SID: 2036854 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 2 • Jun 3, 2022, 12:00 PM

Message:

ET MALWARE WatchDog Coinminer Payload Delivery Domain in DNS Lookup (oracle .zzhreceive .top)

Rule:

alert dns $HOME_NET any -> any any (msg:"ET MALWARE WatchDog Coinminer Payload Delivery Domain in DNS Lookup (oracle .zzhreceive .top)"; dns.query; content:"oracle.zzhreceive.top"; nocase; bsize:21; reference:url,www.cadosecurity.com/tales-from-the-honeypot-watchdog-evolves-with-a-new-multi-stage-cryptojacking-attack/; classtype:coin-mining; sid:2036854; rev:2; metadata:created_at 2022_06_03, performance_impact Significant, confidence High, signature_severity Major, updated_at 2024_09_17, reviewed_at 2024_09_17;)

Created:

Jun 3, 2022, 12:00 PM

Updated:

Sep 17, 2024, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

May 30, 2025, 12:04 AM

Filename:

rules/emerging-malware.rules