Rule History

SID: 2052440 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 1 • Mar 5, 2024, 12:00 PM

Message:

ET MALWARE DNS Query to TA453 Domain

Rule:

alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query to TA453 Domain"; dns.query; bsize:17; content:"tnt200.mywire.org"; nocase; reference:url,cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations; classtype:trojan-activity; sid:2052440; rev:1; metadata:attack_target Client_Endpoint, created_at 2024_03_05, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_05_06, former_sid 2856453;)

Created:

Mar 5, 2024, 12:00 PM

Updated:

May 6, 2024, 12:00 PM

DB Created:

May 6, 2024, 10:00 PM

DB Updated:

Aug 11, 2025, 10:35 PM

Filename:

rules/emerging-malware.rules