""ET DNS APT_NGO_wuaclt C2 Domain micorsofts.net""

SID: 2016569

Revision: 3

Class Type: bad-unknown

Metadata: created_at 2013_03_14, updated_at 2013_03_14

Reference:

• Link

Protocol: udp

Source Network: $HOME_NET

Source Port: any

Destination Network: any

Destination Port: 53

Flow:

Contents:

• Value: "|0a|micorsofts|03|net|00|"

Within:

PCRE:

Special Options:

• nocase

source