Nitro 관련 C&C 도메인 쿼리 탐지

alert udp any any -> any 53 (content:”|10|antivirus-groups|03|com|00|”; nocase;)

alert udp any any -> any 53 (content:”|06|domain|03|rm6|03|org|00|”; nocase;)

alert udp any any -> any 53 (content:”|0a|anti-virus|05|sytes|03|net|00|”; nocase;)

Advertisements

About this entry