[Snort-sigs] Proposed update to 1:28039

Rodgers, Anthony (DTMB) RodgersA1 at ...3985...
Fri Dec 19 14:37:25 EST 2014


Since Upworthy purchased u.pw (http://www.thedomains.com/2013/06/03/upworthy-com-buys-u-pw-as-url-shortener/), should we update INDICATOR-COMPROMISE Suspicious .pw dns query (1:28039) to add the following:

content:!"|01 75 02 70 77 00|"; offset:12; depth:6;

Cheers,

Anthony Rodgers
Security Analyst
Michigan Security Operations Center (MiSOC)





More information about the Snort-sigs mailing list