NF – POLICY ask.com
This alert is triggered when a DNS query attempts to resolve a domain related to "ask.com.".
ID Number
5022505
Signature
alert udp any any -> any 53 (msg:"NF - POLICY ask.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|ask|03|com"; fast_pattern; nocase; distance:0; reference:url,blog.redcanary.com/ask-partner-network-compromise; reference:url,networkforensic.dk; metadata:24112016; classtype:policy-violation; sid:5022505; rev:1;)
Severity
Low
Recommendations/Investigative actions
Determine which device is attempting to access "ask.com" to assess if it’s authorized or not.
Consider restricting access to "ask.com" if it’s against network policy or deemed unnecessary.