""ET DNS APT_NGO_wuaclt C2 Domain micorsofts.com""

SID: 2016570

Revision: 2

Class Type: bad-unknown

Metadata: created_at 2013_03_14, updated_at 2013_03_15

Reference:

• Link

Protocol: udp

Source Network: $HOME_NET

Source Port: any

Destination Network: any

Destination Port: 53

Flow:

Contents:

• Value: "|0a|micorsofts|03|com|00|"

Within:

PCRE:

Special Options:

• nocase

source