Evasive Panda DNS Poisoning Lure dictionary.com
This rule detects highly specific URI patterns associated with Evasive Panda DNS poisoning lures. It looks for requests to 'dictionary.com' that include 'image?id=' and 'dict-homepage.png' within the URI. This combination of URI components is considered high-fidelity for detecting the second-stage shellcode fetching mechanism used by Evasive Panda. The rule explicitly states that legitimate dictionary.com image requests rarely use this exact query pattern, making this a targeted detection for the described threat.
Sigma
