""ET TROJAN Possible Dyre DGA NXDOMAIN Responses (.to)""
SID: 2019884
Revision: 1
Class Type: trojan-activity
Metadata: created_at 2014_12_08, updated_at 2014_12_08
Reference:
-
md5
-
c5d2a2287424ab9508ae15261020e48d
Protocol: udp
Source Network: any
Source Port: 53
Destination Network: $HOME_NET
Destination Port: any
Flow:
Contents:
-
Value: "|00 01 00 00 00 01|" Depth: 6 Offset: 4
-
Value: "|02|to|00|"
-
Value: "|22|"
Within: 1
PCRE: "/^[a-z][a-f0-9]{33}/Ri"
Special Options:
- fast_pattern