ET DOS DNS Amplification Attack Possible Outbound Windows Non-Recursive Root Hint Reserved Port

Query · suricata

content:"|81 00 00 01 00 00|"; depth:6; offset:2;
byte_test:2,>,10,0,relative;
byte_test:2,>,10,2,relative;
content:"|0c|root-servers|03|net|00|"; distance:0;
content:"|0c|root-servers|03|net|00|"; distance:0;
threshold:type both, track by_dst, seconds 60, count 5;
Raw source ET DOS DNS Amplification Attack Possible Outbound Windows Non-Recursive Root Hint Reserved Port · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert udp $HOME_NET 53 -> $EXTERNAL_NET 1:1023 (
    msg:"ET DOS DNS Amplification Attack Possible Outbound Windows Non-Recursive Root Hint Reserved Port";
    content:"|81 00 00 01 00 00|"; depth:6; offset:2;
    byte_test:2,>,10,0,relative;
    byte_test:2,>,10,2,relative;
    content:"|0c|root-servers|03|net|00|"; distance:0;
    content:"|0c|root-servers|03|net|00|"; distance:0;
    threshold:type both, track by_dst, seconds 60, count 5;
    reference:url,twitter.com/sempersecurus/status/763749835421941760;
    reference:url,pastebin.com/LzubgtVb;
    classtype:bad-unknown;
    sid:2023054; rev:2;
    metadata:attack_target Server, created_at 2016_08_12, deployment Datacenter, performance_impact Low, confidence Medium, signature_severity Major, updated_at 2019_07_26;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.