ET EXPLOIT Possible CVE-2015-7547 A/AAAA Record Lookup Possible Forced FallBack(fb set)

Query · suricata

flow:established,to_server;
byte_test:2,<,513,0;
byte_test:1,!&,128,4;
byte_test:1,!&,64,4;
byte_test:1,!&,32,4;
byte_test:1,!&,16,4;
byte_test:1,!&,8,4;
content:"|00 01 00 00 00 00 00 00|"; offset:6; depth:8;
pcre:"/^(?:.[a-z0-9-]{2,}){2,}\x00\x00(?:\x01|\x1c)/Ri";
flowbits:set,ET.CVE20157547.primer;
flowbits:noalert;

Rule dependencies

Feeds into

  • 1 rule read ET.CVE20157547.primer · view all
Raw source ET EXPLOIT Possible CVE-2015-7547 A/AAAA Record Lookup Possible Forced FallBack(fb set) · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert tcp $HOME_NET any -> $EXTERNAL_NET 53 (
    msg:"ET EXPLOIT Possible CVE-2015-7547 A/AAAA Record Lookup Possible Forced FallBack(fb set)";
    flow:established,to_server;
    byte_test:2,<,513,0;
    byte_test:1,!&,128,4;
    byte_test:1,!&,64,4;
    byte_test:1,!&,32,4;
    byte_test:1,!&,16,4;
    byte_test:1,!&,8,4;
    content:"|00 01 00 00 00 00 00 00|"; offset:6; depth:8;
    pcre:"/^(?:.[a-z0-9-]{2,}){2,}\x00\x00(?:\x01|\x1c)/Ri";
    flowbits:set,ET.CVE20157547.primer;
    flowbits:noalert;
    reference:cve,2015-7547;
    classtype:attempted-user;
    sid:2022546; rev:1;
    metadata:created_at 2016_02_18, cve CVE_2015_7547, confidence Medium, signature_severity Major, updated_at 2019_07_26;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.