ET DNS Excessive DNS Responses with 1 or more RR's (100+ in 10 seconds) to google.com.br possible Cache Poisoning Attempt

alert udp any 53 -> $DNS_SERVERS any (
    msg:"ET DNS Excessive DNS Responses with 1 or more RR's (100+ in 10 seconds) to google.com.br possible Cache Poisoning Attempt";
    byte_test:2,>,0,6;
    byte_test:2,>,0,10;
    threshold:type both, track by_src, count 100, seconds 10;
    content:"|06|google|03|com|02|br|00|";
    reference:url,www.securelist.com/en/blog/208193214/Massive_DNS_poisoning_attacks_in_Brazil;
    reference:url,www.zdnet.com/blog/security/massive-dns-poisoning-attack-in-brazil-serving-exploits-and-malware/9780;
    classtype:bad-unknown;
    sid:2013894; rev:5;
    metadata:created_at 2011_11_10, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;
)