ET INFO SUSPICIOUS Java Request to DNSDynamic Dynamic DNS Domain
Sourceet/open
CreatedMarch 15, 2013
UpdatedSeptember 2, 2020
Classificationbad-unknown
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO SUSPICIOUS Java Request to DNSDynamic Dynamic DNS Domain"; flow:to_server,established; http.user_agent; content:"Java/1."; http.host; pcre:"/\.(?:d(?:ns(?:d(?:ynamic\.(?:com|net)|\.(?:info|me))|api\.info|get\.org|53\.biz)|dns01\.com)|(?:f(?:lashserv|e100|tp21)|adultdns|mysq1|wow64)\.net|(?:(?:ima|voi)p01|(?:user|ole)32|kadm5)\.com|t(?:tl60\.(?:com|org)|empors\.com|ftpd\.net)|s(?:sh(?:01\.com|22\.net)|ql01\.com)|http(?:(?:s443|01)\.com|80\.info)|n(?:s360\.info|tdll\.net)|x(?:ns01\.com|64\.me)|craftx\.biz)(\x3a\d{1,5})?$/"; classtype:bad-unknown; sid:2016583; rev:6; metadata:created_at 2013_03_15, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_02;)
Metadata
created at2013_03_15
confidenceHigh
signature severityInformational
tagDescription_Generated_By_Proofpoint_Nexus
updated at2020_09_02
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!