https://live.paloaltonetworks.com/t5/custom-signatures/custom-objects-signature-dns-query-length/m-p/254483#M294 <P><SPAN>Hello<BR /><BR />I am trying to create a custom object / custom spyware signature based on dns-req-section that would alert when the requested domain via dns is longer than x amount of characters.<BR />Currently I am stuck at the pattern requirement to have 7 fixed bytes. Any ideas? </SPAN></P><P>&nbsp;</P><P><SPAN>(We are not using dns proxying)</SPAN></P><P><SPAN>(I'm trying to detect this:&nbsp;</SPAN></P><P><A href="https://blog.talosintelligence.com/2016/06/detecting-dns-data-exfiltration.html" target="_blank" rel="noopener">https://blog.talosintelligence.com/2016/06/detecting-dns-data-exfiltration.html</A>)</P><P>&nbsp;</P><P><SPAN>Thank you in advance<BR />Kind regards<BR />Tim</SPAN></P> Thu, 21 Mar 2019 09:28:25 GMT Tim_Bielders 2019-03-21T09:28:25Z https://live.paloaltonetworks.com/t5/custom-signatures/custom-objects-signature-dns-query-length/m-p/254483#M294 <P><SPAN>Hello<BR /><BR />I am trying to create a custom object / custom spyware signature based on dns-req-section that would alert when the requested domain via dns is longer than x amount of characters.<BR />Currently I am stuck at the pattern requirement to have 7 fixed bytes. Any ideas? </SPAN></P><P>&nbsp;</P><P><SPAN>(We are not using dns proxying)</SPAN></P><P><SPAN>(I'm trying to detect this:&nbsp;</SPAN></P><P><A href="https://blog.talosintelligence.com/2016/06/detecting-dns-data-exfiltration.html" target="_blank" rel="noopener">https://blog.talosintelligence.com/2016/06/detecting-dns-data-exfiltration.html</A>)</P><P>&nbsp;</P><P><SPAN>Thank you in advance<BR />Kind regards<BR />Tim</SPAN></P> Thu, 21 Mar 2019 09:28:25 GMT https://live.paloaltonetworks.com/t5/custom-signatures/custom-objects-signature-dns-query-length/m-p/254483#M294 Tim_Bielders 2019-03-21T09:28:25Z https://live.paloaltonetworks.com/t5/custom-signatures/custom-objects-signature-dns-query-length/m-p/393607#M389 <P>Version 10 does not have this limit, so consider an upgrade.</P> Wed, 24 Mar 2021 21:37:07 GMT https://live.paloaltonetworks.com/t5/custom-signatures/custom-objects-signature-dns-query-length/m-p/393607#M389 nikoolayy1 2021-03-24T21:37:07Z