topic PHP.BroBot sig or custom Sig help in Automation/API Discussions https://live.paloaltonetworks.com/t5/automation-api-discussions/php-brobot-sig-or-custom-sig-help/m-p/27926#M715 <HTML><HEAD></HEAD><BODY><P>Hello,</P><P></P><P>Is there a signature for PHP.BroBot ?</P><P></P><P>If there isn't and I need to make a customer one, I have the following details and would like some help on the best action to be used via data patterns.</P><P></P><P>"Attacks using BroBot tool are to attack DNS servers will result in a large number of UDP packets to port 53 containing a payload of many repeated "A" character (hexadecimal 0x41). "</P><P></P><P></P><P>If the signature has all A's or a bunch of them.. what is the perfect balance of min characters to trigger? is 8 A's enough and then whatever matches 0 or more times after enough?</P></BODY></HTML> Mon, 28 Jan 2013 18:26:48 GMT peter.desfigies 2013-01-28T18:26:48Z PHP.BroBot sig or custom Sig help https://live.paloaltonetworks.com/t5/automation-api-discussions/php-brobot-sig-or-custom-sig-help/m-p/27926#M715 <HTML><HEAD></HEAD><BODY><P>Hello,</P><P></P><P>Is there a signature for PHP.BroBot ?</P><P></P><P>If there isn't and I need to make a customer one, I have the following details and would like some help on the best action to be used via data patterns.</P><P></P><P>"Attacks using BroBot tool are to attack DNS servers will result in a large number of UDP packets to port 53 containing a payload of many repeated "A" character (hexadecimal 0x41). "</P><P></P><P></P><P>If the signature has all A's or a bunch of them.. what is the perfect balance of min characters to trigger? is 8 A's enough and then whatever matches 0 or more times after enough?</P></BODY></HTML> Mon, 28 Jan 2013 18:26:48 GMT https://live.paloaltonetworks.com/t5/automation-api-discussions/php-brobot-sig-or-custom-sig-help/m-p/27926#M715 peter.desfigies 2013-01-28T18:26:48Z