Rule History

alert dns $HOME_NET any -> any any (msg:"ET MALWARE Observed Operation Silent Watch Domain in DNS Lookup (avvpassport .info)"; dns.query; dotprefix; content:".avvpassport.info"; nocase; endswith; reference:url,research.checkpoint.com/2023/operation-silent-watch-desktop-surveillance-in-azerbaijan-and-armenia/; classtype:trojan-activity; sid:2044265; rev:1; metadata:attack_target Client_Endpoint, created_at 2023_02_21, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_02_21;)