-
Notifications
You must be signed in to change notification settings - Fork 2
Expand file tree
/
Copy pathcmc.rules
More file actions
3 lines (3 loc) · 866 Bytes
/
Copy pathcmc.rules
File metadata and controls
3 lines (3 loc) · 866 Bytes
1
2
3
alert udp $HOME_NET any -> any 53 (msg:"CMC-CIRST - CMC_Malicious_Link - DNS request for xnxx.com.xx"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:20; offset: 2; content:"|04|xnxx|03|com|02|xx"; flow:to_server; fast_pattern:only; nocase; classtype:trojan-activity; reference:url,https://www6.cmcinfosec.com; sid:12; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CMC-CIRST - CMC_Malicious_Link - Related URL (xnxx.com.xx)"; content:"xnxx.com.xx"; http_uri; flow:to_server,established; classtype:trojan-activity; reference:url,https://www6.cmcinfosec.com; sid:13; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CMC-CIRST - CMC_Malicious_Link - Related TLS SNI (xnxx.com.xx)"; tls_sni; content:"xnxx.com.xx";flow:to_server,established; classtype:trojan-activity; reference:url,https://www6.cmcinfosec.com; sid:14; rev:1;)