Check again copy/paste tcp flow please and reference url...

Another idea: add byte_test !& 128  for detect dns request ...

If (only) stream5 udp are enabled : Adding on udp rule, flow to_server...

Best Regards

Rmkml

Hi

I indeed borked my copy/paste kung-fu.. :)

alert udp any any -> any 53 (msg:"try2check.me Carding Checker Site DNS
Connection"; content:"|09|try2check|02|me|00|"; nocase;
classtype:bad-unknown; sid:5000001;
ref:"https://cert.xmco.fr/blog/index.php?post/2012/02/23/Try2check.me%2C-le-maillon-fort";
rev:2;)
alert tcp any any -> any 53 (msg:"try2check.me Carding Checker Site DNS
Connection"; content:"|09|try2check|02|me|00|"; nocase;
flow:established,to_/server/; classtype:bad-unknown; sid:5000002;
ref:"https://cert.xmco.fr/blog/index.php?post/2012/02/23/Try2check.me%2C-le-maillon-fort";
rev:2;)

Regards,
elhoim

On 24/02/12 18:56, rmkml <at> yahoo.fr wrote:
> Hi Elhoim,
> Nice rules,
> But Im curious why the second content (0x09) please ?
> Maybe add flow to_server ?
> Maybe nocase are on wrong place ?
> Best Regards
> Rmkml
>
>
>
> -------- Original message -------- Subject: Re: [Emerging-Sigs] Sig
> idea - try2check.me From: Matthew Jonkman To: elhoim <at> gmail.com CC:
> Emerging-sigs <at> emergingthreats.net
>
> Nice, thanks AD.
>
> ANyone have a few minutes to pull the ssl cert from a few hits and see
> if it's consistent? We could sig that as well.
>
> Matt
>
>
> On Feb 24, 2012, at 4:13 AM, AD wrote:
>
> > It is a credit card checker for the carders.
> > They are security conscious, and use a unique hostname & port per
> > client, and https.
> >
> > According to the article they are quite popular in the underground.
> >
> > And thus, here is a little sig to find if some of your users are using
> > that site:
> >
> > alert udp any any -> any 53 (msg: " |09|try2check|02|me|00|";
> > content:"|09|"; nocase; classtype:bad-unknown; sid:5000001;
> >
> ref:"https://cert.xmco.fr/blog/index.php?post/2012/02/23/Try2check.me%2C-le-maillon-fort";
> > rev:1;)
> > alert tcp any any -> any 53 (msg: " |09|try2check|02|me|00|";
> > content:"|09|"; nocase; classtype:bad-unknown; sid:5000002;
> >
> ref:"https://cert.xmco.fr/blog/index.php?post/2012/02/23/Try2check.me%2C-le-maillon-fort";
> > rev:1;)
> >
> >
> > References
> > in french -
> https://cert.xmco.fr/blog/index.php?post/2012/02/23/Try2check.me%2C-le-maillon-fort
>

But new first content it's very fast but possible FN because many other dns flags exist... I prefer byte_test previously proposed ...

Warn: dns over tcp are not same offset than udp...

And test these rules with dig/host/nslookup dns client...

Best Regards

Rmkml

Better?

alert udp any any -> $EXTERNAL_NET 53 (msg:"try2check.me Carding
Checker Site DNS Request"; content:"|01 00 00 01 00 00 00 00 00 00|";
depth:10; offset:2;  content:"|09|try2check|02|me|00|"; fast_pattern;
nocase; distance:0; classtype:bad-unknown; sid:5000001;
reference:url,cert.xmco.fr/blog/index.php?post/2012/02/23/Try2check.me%2C-le-maillon-fort;
rev:3;)

alert tcp any any -> $EXTERNAL_NET 53 (msg:"try2check.me Carding
Checker Site DNS Request"; content:"|01 00 00 01 00 00 00 00 00 00|";
depth:10; offset:2; content:"|09|try2check|02|me|00|"; fast_pattern;
nocase; distance:0; flow:established,to_/server/;
classtype:bad-unknown; sid:5000002;
reference:url,cert.xmco.fr/blog/index.php?post/2012/02/23/Try2check.me%2C-le-maillon-fort;
rev:3;)

On Sat, Feb 25, 2012 at 08:00, rmkml <at> yahoo.fr <rmkml <at> yahoo.fr> wrote:
> alert udp any any -> any 53 (msg:"try2check.me Carding Checker Site DNS
> Connection"; content:"|09|try2check|02|me|00|"; nocase;
>
> classtype:bad-unknown; sid:5000001;
> ref:"https://cert.xmco.fr/blog/index.php?post/2012/02/23/Try2check.me%2C-le-maillon-fort";
> rev:2;)
> alert tcp any any -> any 53 (msg:"try2check.me Carding Checker Site DNS
> Connection"; content:"|09|try2check|02|me|00|"; nocase;
> flow:established,to_/server/; classtype:bad-unknown; sid:5000002;
> ref:"https://cert.xmco.fr/blog/index.php?post/2012/02/23/Try2check.me%2C-le-maillon-fort";
>
> rev:2;)