ET MALWARE Large DNS Query possible covert channel

Query · suricata

content:"|01 00 00 01 00 00 00 00 00 00|"; fast_pattern; depth:10; offset:2;
dsize:>300;
content:!"youtube|03|com|00|";
content:!"sophosxl|03|net|00|";
content:!"|0a|hashserver|02|cs|0a|trendmicro|03|com|00|";
content:!"spamhaus|03|org|00|";
Raw source ET MALWARE Large DNS Query possible covert channel · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert udp $HOME_NET any -> any 53 (
    msg:"ET MALWARE Large DNS Query possible covert channel";
    content:"|01 00 00 01 00 00 00 00 00 00|"; fast_pattern; depth:10; offset:2;
    dsize:>300;
    content:!"youtube|03|com|00|";
    content:!"sophosxl|03|net|00|";
    content:!"|0a|hashserver|02|cs|0a|trendmicro|03|com|00|";
    content:!"spamhaus|03|org|00|";
    classtype:bad-unknown;
    sid:2013075; rev:10;
    metadata:created_at 2011_06_21, confidence Medium, signature_severity Major, updated_at 2024_03_28;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.