Rule History

SID: 2610390 • Source: tgreen/hunting

Versions (4)

Version DetailsCurrent

Rev: 8 • Mar 19, 2025, 4:38 PM

Message:

TGI HUNT Large DNS Query not TCP

Rule:

alert udp $HOME_NET any -> any 53 (msg:"TGI HUNT Large DNS Query not TCP"; content:"|01 00 00 01 00 00 00 00 00 00|"; fast_pattern; depth:10; offset:2; dsize:>512; classtype:bad-unknown; sid:2610390; rev:8;)

Created:

Mar 19, 2025, 4:38 PM

Updated:

Mar 19, 2025, 4:38 PM

DB Created:

Jul 29, 2025, 5:35 PM

DB Updated:

Jul 29, 2025, 5:35 PM

Filename:

hunting.rules