alert udp any 53 -> $HOME_NET any (msg:"ATTACK [PTsecurity] DNS Rebinding attack in progress"; flow:established, from_server; content:"|00 01 00 01|"; offset:4; depth:4; content:"|00 01 00 01 00 00 00 00 00 04|"; distance:0; content:!"|7F|"; within:1; xbits:set, DNSREBINDING.NON_LOCALHOST, track ip_pair, expire 10; flowbits:noalert; classtype:attempted-admin; reference:url, github.com/ptresearch/AttackDetection; sid:10002488; rev:2;)