ET MALWARE HTTP Request to RunForestRun DGA Domain 16-alpha.waw.pl

SID: 2015530Rev: 62 viewsHistory

Sourceet/open

CreatedJuly 27, 2012

UpdatedFebruary 23, 2024

Classificationbad-unknown

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE HTTP Request to RunForestRun DGA Domain 16-alpha.waw.pl"; flow:established,to_server; http.host; content:".waw.pl"; endswith; pcre:"/\.[abedgfihkmlonqpsruwvyxz]{16}\.waw\.pl$/"; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:bad-unknown; sid:2015530; rev:6; metadata:created_at 2012_07_27, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_02_23;)

References

url	blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/
url	blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/

Metadata

created at2012_07_27

signature severityMajor

tagDescription_Generated_By_Proofpoint_Nexus

updated at2024_02_23

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!