Sagan medium stable other

[FORTINET] DNS Request to Monitored Domain Detected

[FORTINET] DNS Request to Monitored Domain Detected

View Source

Detection Logic

alert any any any -> any any (msg: "[FORTINET] DNS Request to Monitored Domain Detected"; content: "type="; content: "subtype="; content: "logid=
| 22
| 1501054802
| 22
| "; content: "msg=
| 22
| Domain is monitored
| 22
| "; content: "action=
| 22
| pass
| 22
| "; parse_src_ip:2; meta_content: "catdesc=
| 22
| %sagan%
| 22
| ", Instant Messaging,File Sharing and Storage,Freeware and Software Downloads,Remote Access,Malicious Websites,Proxy Avoidance,Illegal or Unethical,Hacking,Crypto Mining,Child Sexual Abuse,Gambling,Nudity and Risque,Pornography,Peer-to-peer File Sharing,URL Shortening,Potentially Unwanted Program; meta_nocase; content:"- - - -"; classtype: suspicious-traffic; sid:5017311; rev:3;)

Field Validations

Loading…

Comments (0)

Loading comments...