NF – Generic – DNS Response 127.0.0.1 – Possible sinkholed domain – Check domain
The rule detects DNS responses containing the IP address 127.0.0.1. This rule is used to identify possible sinkholed domains, where malicious domains are intentionally resolved to the loopback address (127.0.0.1) to prevent further communication with malicious servers.
ID Number
5018804
Signature
alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"NF - Generic - DNS Response 127.0.0.1 - Possible sinkholed domain - Check domain"; content:"|00 04 7f 00 00 01|"; reference:url,networkforensic.dk; metadata:28082018; classtype:bad-unknown; sid:5018804; rev:1;)
MITRE ATT&CK Technique
-
Severity
Low
Recommendations/Investigative actions
Authorize the domain. If the domain was approved - archive and baseline the rule. If not - check the connection and investigate the domain and the relevant IP address.