ET MALWARE DNS Query to Pseudo Random Domain for Web Malware (.mynumber.org)

SID: 2018766Rev: 30 views
History
Sourceet/open
CreatedDecember 12, 2012
UpdatedJuly 26, 2019
Classificationbad-unknown
alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query to Pseudo Random Domain for Web Malware (.mynumber.org)"; dns_query; content:".mynumber.org"; nocase; isdataat:!1,relative; pcre:"/^[acdefghijlmopqrtwz]{16}\.mynumber\.org$/"; reference:url,blog.lab69.com/2012/12/another-implementation-of-pseudo-random.html; classtype:bad-unknown; sid:2018766; rev:3; metadata:created_at 2012_12_12, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)

References

urlblog.lab69.com/2012/12/another-implementation-of-pseudo-random.html

Metadata

created at2012_12_12
confidenceMedium
signature severityMajor
tagDescription_Generated_By_Proofpoint_Nexus
updated at2019_07_26

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!