""ET TROJAN Large DNS Query possible covert channel""

SID: 2013075

Revision: 10

Class Type: bad-unknown

Metadata: created_at 2011_06_21, updated_at 2024_03_28

Reference:

Protocol: udp

Source Network: $HOME_NET

Source Port: any

Destination Network: any

Destination Port: 53

Flow:

Contents:

• Value: "|01 00 00 01 00 00 00 00 00 00|" Depth: 10 Offset: 2

• Value: !"youtube|03|com|00|"

• Value: !"sophosxl|03|net|00|"

• Value: !"|0a|hashserver|02|cs|0a|trendmicro|03|com|00|"

• Value: !"spamhaus|03|org|00|"

Within:

PCRE:

Special Options:

• fast_pattern

source