Rule History

SID: 2043164 • Source: et/open

Versions (5)

Version DetailsCurrent

Rev: 3 • Jan 3, 2023, 12:00 PM

Message:

ET ATTACK_RESPONSE PowerShell String Base64 Encoded Text.Encoding (ZXh0LkVuY29k) in DNS TXT Reponse

Rule:

alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell String Base64 Encoded Text.Encoding (ZXh0LkVuY29k) in DNS TXT Reponse"; content:!"v=DKIM"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"ZXh0LkVuY29k"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2043164; rev:3; metadata:attack_target Client_Endpoint, created_at 2023_01_03, deployment Perimeter, performance_impact Low, confidence High, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_12_12;)

Created:

Jan 3, 2023, 12:00 PM

Updated:

Dec 12, 2024, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

Aug 26, 2025, 9:34 PM

Filename:

rules/emerging-attack_response.rules