alert tcp any any -> $HOME_NET any (msg: "ATTACK [PTsecurity] Attempt to crash named using malformed RNDC packet"; flow: established, to_server; content:"_auth"; depth: 20; fast_pattern; content: !"|02 00 00 00|"; within: 4; content: "_ctrl"; content: "_ser"; content: "_tim"; content: "_exp"; reference: cve, 2016-1285; classtype: attempted-dos; reference: url, github.com/ptresearch/AttackDetection; sid: 10000005; rev: 3; )

alert tcp any any -> $HOME_NET any (msg: "ATTACK [PTsecurity] Attempt to crash named using malformed RNDC packet"; flow: established, to_server; content:"_auth"; depth: 20; fast_pattern; content: !"|01 00 00 00|"; distance: 10; within: 4; content: "_ctrl"; content: "_ser"; content: "_tim"; content: "_exp"; reference: cve, 2016-1285; classtype: attempted-dos; reference: url, github.com/ptresearch/AttackDetection; sid: 10000006; rev: 3; )