alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"ET INFO Authoritative Nameservers in DNS Query Response"; content:"|81 80 00 01|"; offset:2; depth:5; fast_pattern; content:"|00 02 00 01|"; distance:0; threshold:type limit,count 1,seconds 300,track by_dst; reference:url,ietf.org/rfc/rfc1035.txt; classtype:misc-activity; sid:2059172; rev:1; metadata:attack_target Client_Endpoint, tls_state plaintext, created_at 2025_01_13, deployment Perimeter, performance_impact Significant, confidence High, signature_severity Minor, updated_at 2025_01_13; target:dest_ip;)