Rule History

alert dns $HOME_NET any -> any any (msg:"ET MALWARE BrushaLoader CnC DNS Lookup"; dns.query; content:"cheapairlinediscount.site"; nocase; endswith; reference:url,blog.talosintelligence.com/2019/02/combing-through-brushaloader.html; classtype:command-and-control; sid:2026953; rev:3; metadata:created_at 2019_02_21, deployment Perimeter, malware_family BrushaLoader, performance_impact Low, confidence Medium, signature_severity Major, updated_at 2020_09_16;)