id: ptr-fingerprint

info:
  name: PTR Detected
  author: pdteam
  severity: info
  description: A PTR record was detected. A PTR record refers to the domain name.
  classification:
    cwe-id: CWE-200
  metadata:
    max-request: 1
  tags: dns,ptr

dns:
  - name: "{{FQDN}}"
    type: PTR
    matchers:
      - type: regex
        part: answer
        regex:
          - "IN\tPTR\\t(.+)$"

    extractors:
      - type: regex
        group: 1
        regex:
          - "IN\tPTR\t(.+)"
# digest: 4a0a00473045022027a6c832dc230b202a1b5bea244368b9dd52bce8a3093ea68bde4c2d1f7aa1b1022100840ac44bbb98cf511bab413bf6c96239fba295f31e274999ad0059e51d9e9cfc:922c64590222798bb761d5b6d8e72950