dns2rule.pl

dns2rule.pl

#!/usr/bin/perl
# usage:
# perl dns2rule.pl "context string" < list.of.newline.delimited.domains.txt

use strict;
use warnings;

my $addon_string = shift @ARGV;

foreach my $domain (<>) {
  # remove trailing newline or carraige return
  $domain =~ s/[\r\n]*$//g;
  next unless (length($domain) > 0);
  printf('alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"BLACKLIST DNS request for domain %s%s"; flow:to_server; byte_test:1,!&,0xF8,2; content:"%s|00|"; fast_pattern:only; metadata:impact_flag red, service dns; classtype:trojan-activity;)'."\n",
    $domain,
    defined($addon_string)?" $addon_string":"",
    join("",map { "|".sprintf("%02x",length($_))."|".$_ } split(m/\./,$domain))
  );
}