Rule History

alert dns $HOME_NET any -> any any (msg:"ET MALWARE BrushaLoader CnC DNS Lookup"; dns.query; content:"serveselitmail.science"; nocase; endswith; reference:url,blog.talosintelligence.com/2019/02/combing-through-brushaloader.html; classtype:command-and-control; sid:2026968; rev:3; metadata:created_at 2019_02_22, malware_family BrushaLoader, confidence Medium, signature_severity Major, updated_at 2020_09_16;)