ET DELETED Possible Kelihos .eu CnC Domain Generation Algorithm (DGA) Lookup NXDOMAIN Response

7.0.35.0SID: 2014372Rev: 8Disabled1 views
Sourceet/open
Fileemerging-deleted.rules
CreatedMarch 14, 2012
UpdatedMay 4, 2023
Classificationcommand-and-control
alert udp any 53 -> $HOME_NET any (msg:"ET DELETED Possible Kelihos .eu CnC Domain Generation Algorithm (DGA) Lookup NXDOMAIN Response"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|02|eu|00|"; fast_pattern; pcre:"/\x00\x07[a-z0-9]{7}\x02eu\x00/"; threshold:type both, track by_src, count 2, seconds 60; reference:url,web.archive.org/web/20120320025955/http://www.abuse.ch/?p=3658; reference:url,marc.info/?t=135207100900022&r=1&w=2; reference:url,www.justice.gov/opa/pr/justice-department-announces-actions-dismantle-kelihos-botnet-0; classtype:command-and-control; sid:2014372; rev:8; metadata:created_at 2012_03_14, confidence High, signature_severity Unknown, updated_at 2023_05_04;)

References

urlweb.archive.org/web/20120320025955/http://www.abuse.ch/?p=3658
urlmarc.info/?t=135207100900022&r=1&w=2
urlwww.justice.gov/opa/pr/justice-department-announces-actions-dismantle-kelihos-botnet-0

Metadata

created at2012_03_14
confidenceHigh
signature severityUnknown
updated at2023_05_04

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!