alert dns $HOME_NET any -> any any (msg:"ET MALWARE APT-C-59 Related Domain in DNS Lookup"; dns.query; content:"itoxtlthpw.com"; nocase; bsize:14; reference:url,otx.alienvault.com/pulse/61811ddc259f23fdd630e196; classtype:domain-c2; sid:2034334; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_11_03, deployment Perimeter, malware_family apt_c_59, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_11_03;)