""ET TROJAN DNS Reply Sinkhole Microsoft NO-IP Domain""

SID: 2018642

Revision: 3

Class Type: trojan-activity

Metadata: created_at 2014_07_04, updated_at 2022_07_13, reviewed_at 2024_03_07

Reference:

Protocol: udp

Source Network: any

Source Port: 53

Destination Network: $HOME_NET

Destination Port: any

Flow:

Contents:

• Value: "|00 01 00 01|"

• Value: "|00 04 cc 5f 63|"

Within: 5

PCRE:

Special Options:

source