Rule History

alert dns any any -> any 53 (msg: "SUSPICIOUS [PTsecurity] Possible DecoyDog DNS Tunneling"; flow: to_server; dsize: >80; content: "|00 01 00 00 00 00 00 00 08|"; offset: 4; depth: 9; content: "|20|"; distance: 8; within: 1; content: "|18|"; distance: 32; within: 1; pcre: "/^.{10}\x08[a-z0-9]{8}\x20[a-z0-9]{32}\x18[a-z0-9]{24}/"; threshold: type threshold, track by_dst, count 2, seconds 125; reference: url, https://insights.infoblox.com/resources-whitepaper/infoblox-whitepaper-decoy-dog-is-no-ordinary-pupy-distinguishing-malware-via-dns; reference: url, rules.ptsecurity.com; classtype: misc-activity; sid: 10010052; rev: 1;)